SECOND p-DESCENTS ON ELLIPTIC CURVES 
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Abstract. Let p be a prime and let C be a genus one curve over a number 
field k representing an element of order dividing p in the Shafarevich-Tate 
^ group of its Jacobian. We describe an algorithm which computes the set of D 

' in the Shafarevich-Tate group such that pD = C and obtains explicit models 

_ for these D as curves in projective space. This leads to a practical algorithm 

for performing explicit 9-descents on elliptic curves over Q. 



1. Introduction 

Let E be an elliptic curve over a number field k. The celebrated Mordell-Weil 
Theorem asserts that the set E(k) of fc-rational points on E is a finitely generated 
abelian group. One would like to be able to determine this group in practice. In 
addition to the Mordell-Weil group, there is another important arithmetic invariant 
of an elliptic curve: the Shafarevich-Tate group lH(E/k). An n-descent on an 
elliptic curve is a way to obtain information on both of these groups. For each 
integer n > 2, there is an exact sequence of finite abelian groups relating the two: 

E(k)/nE{k) -> Sel {n) (E/k) -> UI(E/k)[n] -> 0. 

The middle term is a finite group known as the n-Selmer group. An explicit n- 
descent on E computes the n-Selmer group and represents its elements as curves 
in projective space. Determination of Ser n '(E/k) yields explicit bounds on the 
Mordell-Weil rank and partial information on the Shafarevich-Tate group. In ad- 
dition, the models produced can often be used to find generators of large height in 
the Mordell-Weil group or to study explicit counterexamples to the Hasse principle. 

The technique of descent to study solutions of Diophantine equations goes back 
at least to Fermat. The idea is to parameterize the rational points on a given va- 
riety by the rational points on some finite collection of coverings. Reichardt and 
Lind used descent arguments to produce the first known counterexample to the 
Hasse principle |26[ 132) . In a similar spirit Selmer studied diagonal cubic curves to 
systematically obtain counterexamples of degree 3 |37) . The algorithm presented 
in this paper generalizes his method to arbitrary cubic curves. In one of the first 
applications of computers to number theory Birch and Swinnerton-Dyer [1] studied 
the Mordell-Weil groups of elliptic curves over Q using 2-descents. These compu- 
tations produced empirical evidence motivating their famous conjecture. Together 
with deep results of Kolyvagin, Wiles and others [H [2H US], descents have now 
been used to verify the full conjecture for all elliptic curves over Q of rank < 1 and 
conductor < 5000 ITS. 
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Historically 2-descents were first performed using an explicit enumeration of 
certain homogeneous spaces of the elliptic curve. While applicable in principle 
to larger n and over arbitrary number fields, the method is quickly defeated by 
combinatorial explosion when one ventures much beyond 2-descents over (Q>. There 
is an alternative approach which is based more closely on the original proof of 
the Mordell-Weil theorem [29] [44]. First one computes the n-Selmer group as a 
subgroup of a finite exponent quotient of the multiplicative group of some etale 
fc-algebra. One is then left with the task of constructing explicit models for the 
coverings from representatives in the algebra. The first step requires deep arithmetic 
knowledge, such as iS-class and -unit group information, of the constituent fields 
of the algebra. It is only in the past two decades or so that improved computing 
power, higher-level computer algebra software and better theoretical understanding 
have made computations using this alternative approach feasible. 

Typically the algebra is related in some way to the group E[n] of n-torsion 
points on E. For arbitrary n there is an algorithm involving the etale algebra 
R = Ma,p k (E[n] x E[n],k) of Galois equivariant maps from E[n] x E[n] to an 
algebraic closure of k (see p~7l 1.3.2]). Generically R contains an extension of k 
of degree 0(n 4 ) making the arithmetic computations infeasible in practice. In 
general one can reduce computation of the n-Selmer group to the case that n is 
a prime power. For n = p a prime, there is a method using the etale fc-algebra 
Ma,p k (E[p], k). Generically this splits as a product of k with some field extension A 
of degree p 2 — 1. The p-Selmer group is then computed as a subgroup of A x /A xp . 
The situation for n = 2 is described in [41] and in [35] 03] where 2-descent on 
Jacobians of hyperelliptic curves is also considered. For odd p, this was developed 
in the papers |20[|36| . For p = 2, 3, these algorithms are practical over number fields 
of moderate degree and discriminant and are part of the Magma computer algebra 
package [2]. For larger p these computations may be possible when E admits a 
p-isogeny [19l [21] [22] [28] [36] , but for general elliptic curves p-descents for p > 5 are 
rather impractical. 

In the second step, one starts with representatives for the n-Selmer group in 
some etale algebra and wants to construct explicit models for the corresponding 
coverings. For n > 3, the problem is studied in the series of papers [17], the 
situation for n — 2 having been well-known for some time (9] Section 15]. For 
n = 2, one gets double covers of the projective line ramified in 4 points. The 
models for n = 3 are plane cubics. For n > 4 one has degree n curves in P" _1 
whose homogeneous ideal is generated by n(n — 3)/2 quadrics. Examples of the 
utility of such models for computing generators of large height abound: [3] [X5l [23] 
all contain striking examples. In addition to this and the ability to produce explicit 
elements in the Shafarevich-Tate group, obtaining such models explicitly opens the 
possibility of doing higher descents. 

To our knowledge, the only previously existing practical methods for computing 
the n-Selmer group of a general elliptic curve when n is a higher prime power are for 
n = 4[5l[IOl|2g|l6]andn = 8S2]. Rather than performing a direct 2 m -descent, 
these proceed by performing 2-descents in a tower of coverings. For example, the 
output of a 2-descent on E is a finite collection of double covers of P 1 ramified 
in four points. A second 2-descent computes the collection of everywhere locally 
solvable 2-coverings of one (or all) of these. The running time is dominated by the 
computation of arithmetic information in the etale algebra corresponding to the 
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ramification points of the double cover of P 1 . This is typically a field of degree 4, 
making the algorithm far more efficient than a direct 4-descent on E. The output 
of a second 2-descent is a finite collection of quadric intersections in P 3 . These 
become the input for Stamminger's method for third 2-descent. 

We present the analogous method for performing an explicit p 2 -descent on an 
elliptic curve when p is an odd prime. The first step is an explicit p-descent on E, 
yielding models for the elements of Sel^ (E/k) as genus one normal curves of degree 
p in P p_1 . We then perform an explicit p-descent on some curve C thus obtained. 
This is a computation of the finite set Se\^ p \C/k) of everywhere locally solvable p- 
coverings of C which produces explicit models for its elements as genus one normal 
curves of degree p 2 in P p _1 . Performing this computation for each element in 
one obtains information that is just as good as that obtained by an 
explicit p 2 -descent on E. 

As is typical for descents, the running time of our algorithm is dominated by 
the computation of class and unit group information in a certain etale fc-algebra. 
In our situation this is the etale fc-algebra of degree p 2 corresponding to the set of 
flex points of C. In addition, our algorithm requires computations in a second etale 
algebra of degree at most p 2 (p 2 — l)/2. The most expensive operation required 
there is the extraction of p-th roots of elements known to be p-th powers. When 
p = 3, one can get away with an algebra of degree 12, where such computations 
are entirely feasible. For larger p, however, this provides another barrier to the 
practical applicability of the algorithm. 

Our algorithm is practical for p = 3 and k = Q and we have implemented it in 
the computer algebra system Magma 2 J . Using this we are able to exhibit elements 
of order 9 in the Shafarevich-Tate group of an elliptic curve. Alternatively, if the 
3- primary part of the Shafarevich-Tate group has exponent 3, then the algorithm 
can be used to prove this unconditionally. We give several examples. In the first we 
consider the smallest elliptic curve (ordered by conductor) with elements of order 
9 in its Shafarevich-Tate group. Using first and second 3-descents on on it and an 
isogenous curve we compute the full 3-primary part of III. In a second example, 
we give an explicit model in P 8 for an element of order 9 in the Shafarevich-Tate 
group of an elliptic curve with irreducible mod 3 representation. We also give an 
example verifying the full Birch and Swinnerton-Dyer conjecture for a CM elliptic 
curve over Q with Shafarevich-Tate group of order 144. 

1.1. Organization. The first two sections contain the necessary background in- 
formation for setting up our descent. The majority of the material here should 
be well known to the experts. The only possible exceptions are our extension of 
the obstruction map to composite coverings and Proposition 12. 1[ which is slightly 
more general than the the usual results appearing in the literature. In Section [2] 
we establish a rather general framework for studying Picard groups of curves by 
using Galois equivariant families of functions on the curve. Ideas of this ilk have 
tended to play a role in most methods of explicit descent. Section [3] introduces the 
main objects of study: n-coverings. We deal with their basic properties and those 
of related objects such as genus one normal curves and the obstruction map (most 
of this can be found in |TT1 I] ) . 

The following three sections develop the theoretical basis for the algorithm and 
the cohomological interpretation of second p-descents. For the most part we work 
with a fixed genus one normal curve C of degree p defined over an arbitrary perfect 
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field of characteristic not equal to p. The main object of study is the set of isomor- 
phism classes of p-coverings of G with trivial obstruction. The primary tool is the 
descent map, which gives a concrete algebraic realization of this rather abstractly 
defined set. 

In Section [4] we identify the domain of the descent map as a principal homoge- 
neous space for a certain subgroup of H 1 (_ft', E[p\). We give both a cohomological 
description of this subgroup and explicit representations of its members as elements 
of the multiplicative group of a certain etale A-algebra H . The descent map is then 
defined in Section [5] as a map taking values in a certain quotient of H x . Ultimately 
we will see that the descent map may be interpreted as an afhne map (loosely 
speaking a linear map followed by a translation), so that the material of Section 0] 
can be understood as a study of its linear part. In Sections 15.11 and 15.21 we show 
that the descent map is injective and determine its image. Then in Section |6] we 
construct an explicit inverse to the descent map, which shows how to obtain explicit 
models for elements in the image of the descent map as genus one normal curves of 
degree p 2 in P p _1 . 

Following this we specialize in Section [7] to the case that the base field is a 
number field. Armed with the material of the preceding sections, computation of 
the Selmer set is almost routine. The descent map gives a bijection from Sel^ (C/k) 
onto its image, which we call the algebraic p-Selmer set. This gives an algebraic 
presentation of the p-Selmer set which is amenable to machine computation. After 
outlining the complete algorithm we conclude with a small selection of examples in 
Section El 

1.2. Notation. If Q is an abelian group and n > 1, we use Q[n] to denote the 
subgroup of Q consisting of elements which are killed by n. For a commutative ring 
R we use R x to denote the multiplicative group of invertible elements. 

The symbol K will always denote a perfect field and p will always denote a prime 
number not equal to the characteristic of K. We always assume we have a fixed 
algebraic closure K of K and any algebraic extension of K we write down is taken 
to be a subfield of K. We write Gk for the absolute Galois group of K . For n 
prime to the characteristic of K we use fj, n to denote the G/f-module of n-th roots 
of unity in K. Since we restrict to perfect fields, the term local field will be used 
to mean the completion of a number field at some prime. 

If K C L is an extension of fields and A is a if -algebra, then A ®k L is an 
L-algebra which we will denote simply by Al. In the particular case L = K, the 
notation A will also be used to denote A ®k K. If <f> : A — > B is a morphism of 
if-algebras, the induced map Al — > Bl will also be denoted by <f). 

For a smooth, projective and absolutely irreducible curve G defined over K and 
a commutative A-algebra A, we write C ®k A for the scheme C X-s pec (K) Spec(A). 
When A — K, we also write C — C ®k K. We use k(C) and k(C) to denote the 
function field of C and its Gj^-invariant subfield, respectively. We use Div(C) to 
denote the free abelian group on the set of ^-points of C. Its elements are called 
divisors and will often be written as integral linear combinations of points. If we 
wish to make it clear that we are considering a point as a divisor, we will use square 
brackets. So [P] £ Div(C') is the divisor corresponding to P G C{K), The action of 
Gk on points extends to an action on divisors. We use Div(C) for the Gif-invariant 
subgroup and refer to its elements as A'-rational divisors. A closed point of the K- 
scheme G corresponds to a Galois orbit of points in G(A > ). As such a closed point 
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may be interpreted as an element of Div(G). In fact, Div(C) is the free abelian 
group on such closed points. We denote the divisor of a function / <E k(C) x by 
div(/). 

Two divisors are said to be linearly equivalent if their difference is equal to 
div(/) for some rational function / £ n(C) x . The group of principal divisors is 
Princ(G) = {div(/) : / G k(C) x }. It follows from Hilbert's Theorem 90 that the 
Gx-invariant subgroup, Princ(C) = Princ(G) K , is the group of divisors that are 
divisors of functions in k(C) x . We use Pic(G) to denote the group of divisors 
modulo principal divisors. We remind the reader that not every /^-rational divisor 
class can be represented by a if -rational divisor (for an example see [7]). Since the 
degree of the divisor associated to a rational function is 0, there is a well-defined 
notion of degree for divisor classes in Pic(G). We denote the set of divisor classes 
of degree i £ Z by Pic*(G). We use similar notation for the other groups defined 
above. The group Pic°(C) Gk may identified with the group of if-rational points 
on the Jacobian of G. 

Acknowledgements. The majority of this paper is taken from the author's PhD 
thesis [18] . It is a pleasure to thank Michael Stoll for introducing me to this 
topic and for sharing his insights, Tom Fisher for his careful reading of the thesis 
and several useful comments, Steve Donnelly for helpful discussions relating to the 
implementation and the anonymous referee for their remarks. 

2. Derived Gr-sets and descent on Picard groups 

In this section we give a rather general recipe for writing down homomorphisms 
from the Picard group of a curve into a finite exponent quotient of some etale K- 
algebra. The vast majority of explicit descents, whether they be on curves or their 
Jacobians, make use of such a map (see for example the philosophy described in 
[55]). 

2.1. Etale A"-algebras and G^-sets. If f2 is a finite G/f-set, define A(fl) = 
Map(i7, K) to be the -ftf-algebra of maps from f2 to K. There is a natural action of 
Gk on A(£l) defined by 

<jf : (</>(x <T ~ 1 ))°' . 

As a A-algebra A(Q) is isomorphic to Y[f=i K, but the action of Gk is twisted by 
the action on Q. The Gk invariant subspace of A(£l) is the space of G if -equivariant 
maps Ma,p K (£l, K) := Map(fi, K) Gk . This is an etale if-algebra; it splits as a 
product of finite extensions of K corresponding to the orbits in 57. This defines an 
anti-equivalence between the categories of finite Gi<--sets and etale if -algebras. 

We will frequently find ourselves working with objects defined over such al- 
gebras, e.g. varieties, points, functions, etc. From a scheme-theoretic point of 
view this presents no difficulty. It will, however, be convenient to interpret these 
objects as Galois equivariant maps. For example suppose G is a if -variety and 
A = Map K (n, K). Then G <E>k A is a scheme over A. Geometrically it is a dis- 
joint union of copies of G parameterized by fi. We will abuse notation by writing 
k(C ®k A) for k(C) <8>k A and referring to its elements as rational functions on 
G ® K A. We may interpret such a rational function as a Galois equivariant map 
H —> k(C) x or equivalently as a Galois equivariant family of rational functions 
f u £ k(C) x indexed by u £ il. The Galois equivariance means that (/ W ) <T = fw 
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for all a G Gk- The divisor of / can be interpreted as a Galois equivariant map 
il — > Div(C), and so on. 

Similarly, for n prime to the characteristic of K, we define /J, n (A) = Map(0, /z n ). 
This is the n- torsion subgroup of A x . We mention here the generalization of 
Hilbert's Theorem 90 to etale algebras which states that K 1 (K 1 A X ) = 0. To 
prove it one uses Shapiro's Lemma to reduce to the usual Theorem 90 for fields. 
Using this with the Kummer sequence (as one does for fields) one is lead to an 
isomorphism R 1 (K, /i n (A)) ~ A x /A xn . 

If ^, fl are finite G^-sets, we will say that ^ is derived from fl if the elements of 

are unordered tuples (multisets) of elements of and the action on "J is induced 
by that on O. For example, the set of unordered pairs (distinct or not) of elements 
in is a derived G/f-set. One can also interpret the elements of \1/ as formal 
integral linear combinations of elements of f2 with nonnegative coefficients. In this 
interpretation we write b G W as a sum n a a of distinct elements a € f2. 

To Q and ^ we associate etale if-algebras, A(Q) = Map K (Q,K) and A(^f) = 
Map K K). If VP is derived from f2 as a Gx-set, then we define the induced norm 
maps between the corresponding algebras: 

A(Q) = Map K {Q, K)3(j)^ ^(6 = ^ n a a) ^ JJ <K a )" a ^ e Map K (*, K) = A{^) . 

2.2. Descent on Picard groups. Let G be a smooth, absolutely irreducible pro- 
jective curve over a perfect field K. Let ft C C(K) be a finite G if -set of geometric 
points on C and ^ C Div(G) a finite G/f-sct of effective divisors on C which are 
supported on 0. As above A(fl) and A(^f) denote the corresponding etale K- 
algebras. As a G^-set is derived from and we have an induced norm map 
d : A(Sl) -)• 

Now consider a rational function 

f=(U) G k(G ®x A(*)) x =Map K (*,K(G) x ). 

We consider this either as a function on C ®k A(ty) or as a Galois equivariant 
family of rational functions in k(C) x parameterized by tp € ^- We interpret the 
divisor of /, an element of Div(C <S>k A(^)), as a Gif-equivariant map "J" — > Div(G). 
We write div(/) as a difference of effective divisors. This can be interpreted as a 
difference of a pair of G^-equivariant maps [/]o, [f]oo ■ * — > Div(G) whose values 
at tp G "J/ are the zero and pole divisors of /,/,, respectively. Now suppose / satisfies 

(1) W>G*, [/] (^)=V, and 

(2) V"0 G "J/ and er G G K , [fU{V) = L/WVO- 

The first condition says that ip is the zero divisor of the function G n{C) x . The 
second condition amounts to saying that the map [f]oo ■ ^ — > Div(C) is constant 
on each Gif-orbit in The Galois equivariance then implies that, on each orbit 
O C f, the value of [f]oo is some if -rational divisor da G Div(G). We write each 
as a sum 

do = ^-.vV , 
v 

of closed points V and set mo = gcd(mo,-p) (recall that a closed point corresponds 
to a G/f-orbit of points in C(K)). Using these weights, we define a map 

i:K3a^ (a m °) G JJ A(O) = ) 
o 



SECOND p-DESCENT 



7 



Proposition 2.1. With notation as above, let d = J2p n p[P] Div(C) (written 
as a sum of K -points of C) be any K -rational divisor on C with support disjoint 
from all zeros and poles of the . 

(1) Evaluating f on d gives a well-defined element f(d) :— Y[p f(P) np £ 
.li>l<: . 

(2) / induces a unique homomorphism 

Pic(0- A ^ 



i{K x )d(A(Vt) x ) 

with the property that, for all d as above, the image of the class of d is equal 
to the class of f(d). 

Proof: Any rational function h € k(C) x defines a homomorphism from the group 
of divisors of C with support disjoint from the support of div(/i) to the multiplicative 
group of K by 

d = Y^ n P p ^ K d ) = n h ( p ) np G K x . 

If K' is some extension of K and h is defined over K', then this restricts to give a 
homomorphism from the group of fC'-rational divisors with support disjoint from 
that of div(h) into K' x . If / is as in the proposition, then it is defined over A(^>) 
which splits as a product of extensions of K, so the first statement in the proposition 
is clear. 

For the second, define 

/: Pic(C)^ U * ] 



i(K x )d(A(n) x ) 

by setting the value of (j>f on 5 G Pic(C) equal to the class of f(d), where d £ Div(C) 
is any X-rational divisor representing S with support disjoint from Q and [/]oo- If 
this is well-defined, then it is clearly the unique homomorphism with the stated 
property. 

First we argue that such d exists. This follows from [25, page 166] where it is 
shown that any if-rational divisor class which is represented by a if-rational divisor 
contains a if-rational divisor avoiding a given finite set (see also footnote to 
page 4]). Next we use Weil reciprocity to show that the result does not depend on 
the choice for d. 

Let h € /t(C) x be any rational function whose zeros and poles are disjoint from 
those of all of the fa. We will show that /(div(/i)) G L{K x )d(A(n) x ), from which 
the proposition follows. For each ?/» € f, the divisor of h is prime to 

dM/*) = [/]o(V0 - [fUW = V - [/]oo(V0 ■ 
So by Weil reciprocity, 

Interpreting this as a map we have 

/(div(M) = £ Map K (*,^ x ) = A(*) x ■ 
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Define a £ M&p K (Q, K x ) = A(n) x by a : SI 3 ui i-> h(u) £ K x . Now consider 
d{a) £ Map K (^,K x ) = A(^) x . The value of d{a) at tp = E € * is 

This shows that ft([/] ) - 9(a) € d(A(Q) x ). 

It remains to show that ft([/]<x>) € i(if x ). Recall that the value of [/]oo on the 
orbit O C 9 is the divisor do = E-p m o,vV and that mo = gcd(mo,p). The 
are closed points on G. In particular, each is a if -rational divisor and we know how 
to evaluate ft at V to obtain an element in if x . Extending by linearity we have 
that the value taken by ft([/]oo) on any G^-orbit O C # is J[ v h(V) m °< v , which 
is a product of tuq p-th powers in if x . A product of mo,p-th powers is clearly 
a gcd(mo,p)-th power, so the value of ft([/]oo) ° n C is m K xm ° . It follows that 
ft([/]oo) € i(if x ). This completes the proof. □ 

Remark: To do a p-descent on an elliptic curve E with Weierstrass equation y 2 — 
f{x) one typically uses a Galois equivariant family of functions with zeros of order p 
at the nontrivial p-torsion points and poles of order p at the identity. For example, 
whenp = 2 one can take the family of functions x— 9 where 9 runs through the roots 
of f(x). The Proposition gives a homomorphism Pic(E) — > A x /A xp , where A is the 
etale algebra associated to the Gif-set of nontrivial p-torsion points. The restriction 
of this to Pic°(£0 =E(K) can be identified with connecting homomorphism in the 
Kummer sequence for E associated to multiplication by p. 



3. n-COVERINGS 

Definition 3.1. Let C be a smooth, projective and absolutely irreducible curve 
defined over K with Jacobian E and n > 2 prime to the characteristic of K . An 
n-covering of G is an Stale morphism it : D — > G of absolutely irreducible curves 
which is geometrically Galois with group isomorphic to E[n] as a Gk -module. Two 
n-coverings are isomorphic if they are isomorphic as C -schemes. We denote the set 
of all K -isomorphism classes of n-coverings of C defined over K by Cov (n) (G/if). 
When K = k is a number field, we define the n-Selmer set of C, Be\^ n '{C/k), to be 
the set of k-isomorphism classes of n-coverings of C which have points everywhere 
locally. 

Geometrically, every n-covering of G is obtained by pulling-back the multiplica- 
tion by n map via a suitable embedding of G into its Jacobian. This follows from 
geometric class field theory and the fact that there is a unique subgroup of E(K) 
isomorphic to E[n\. When G — E is an elliptic curve, every n-covering of E can 
be viewed as a twist of the multiplication by n map on E. This gives a canonical 
choice for the trivial n-covcring of E. So, by the twisting principle, Cov {n) (E/K ) 
is canonically isomorphic to H 1 (if , i?[n]) and, as such, carries the structure of an 
abelian group. More generally, all n-coverings of G are twists of one another. So 
(provided it is nonempty) we may consider Cov^ (C/K) as principal homogeneous 
space for H 1 (if, E[n]) with the action being given by twisting. 

The n-Selmer set is finite and (at least in principle) computable [11]. We refer 
to its computation as an n-descent on C. When G = E is an elliptic curve the 
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n-Selmer set is a finite subgroup of H (k, E[n]) and sits in a short exact sequence 

(3.1) -> E{k)/nE(k) -> Sel (n) (£/fc) -> m(fc,#)[n] -> 

(see [101 Theorem X.4.2]). Classical descent theory (going back to Chcvalley-Weil 
[11] ) tells us that the rt-Selmer set yields a finite partition of the rational points on 
C: 

C(k)= (J n(D(k)). 

(D,7r)eScl(")(C/fc) 

In particular, the emptiness of the n-Selmer set is an obstruction to the existence 
of rational points on C. But even when C(k) ^ 0, explicitly computing the n- 
Selmer set can be very useful for finding points of large height on C (and ultimately 
generators of large height on the Jacobian of C). 

3.1. Projective models. Let C be a smooth, projective and absolutely irreducible 
genus one curve defined over if with Jacobian E. For any if-rational divisor of 
degree n > 2 on C, the associated complete linear system gives rise to a morphism 
from C to P™ -1 defined over if . For n — 2 this results in a double cover of P 1 
ramified in four points. For n > 3, the complete linear system yields an embedding 
C ^ P" _1 . The image is called a genus one normal curve of degree n. For n = 3, 
the image of C is a plane cubic curve. For larger n, the homogeneous ideal of the 
image is generated by a if -vector space of quadrics of dimension n(n — 3)/2. Two 
genus one normal curves of degree n are said to be if -equivalent if they can be 
identified by a if -automorphism of P™ -1 . 

More generally, the complete linear system associated to any if-rational divisor 
class of degree n > 2 on C gives rise to a if -morphism C — > S from C to a Brauer- 
Severi variety S of dimension n-1 (see [351 P- 160], [HI 1.1.20] or QH Section 3]). 
Conversely, any morphism from C to an n — 1 dimensional Brauer-Severi variety <S* 
such that the image is not contained in a linear subvariety gives rise to a if-rational 
divisor class on C by pulling back the class of a hyperplane on S ~ P™ _1 . 

This leads to the notions of torsor divisor class pairs and Brauer-Severi diagrams. 
The data for a torsor divisor class pair consists of a if -torsor C under E and a if- 
rational divisor class of degree n on C. The corresponding morphism C — > S 
is called a Brauer-Severi diagram. In [17l I, Section 1] it is shown that, up to 
appropriate notions of isomorphism, torsor divisor class pairs and Brauer-Severi 
diagrams are both parameterized by the group H 1 (if , E[n}). Recall that this group 
also parameterizes n-coverings of E. If (C, p) is an n-covering, then there exists an 
isomorphism ijj : C — ?> E defined over K such that p — n o i/j. This gives C the 
structure of a if-torsor under E. The pull-back of ti[Qe] by ip defines a if-rational 
divisor class on C. One can show that this gives a torsor divisor class pair, whose 
class in H 1 (if, E[n]) is the same as that of (C, p). Thus the Brauer-Severi diagram 
corresponding to (C, p) is the map C — > S given by the complete linear system 
associated to the divisor tp*n[0E]- This results in a model for C as a genus one 
normal curve of degree n in P n_1 if and only if iP*u[0e] is linearly equivalent to 
some if-rational divisor. 

Conversely, a genus one normal curve C of degree n determines the class of an 
n-covering (C,p) in Cov^ n \E/K) = H 1 (if, E[n]) up to composition with an auto- 
morphism of E. The possibilities correspond to the finitely many nonisomorphic 
structures for C as a if-torsor under E. 
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Definition 3.2. A point x on a genus one normal curve of degree n > 3 is called 
a flex point if there is a hyperplane in P™ meeting C in x with multiplicity n. 

The set of flex points X on C is defined by a geometric property, so it is a 
Gx-set. If C is endowed with the structure of an n-covering p : C — > E, then 
X = p _1 (Ob) is the fiber above the identity on E, and the corresponding action 
of E on C restricts to a simply transitive action of E[n] on X. This gives X 
the structure of an E[n]-torsoT; its class in H 1 (if , E[n\) is the same as that of the 
n-covering (C,p) (see QjJ I Section 1]). It follows also that #X = n 2 . 

3.2. The obstruction map. Recall that Pic(C) is the quotient of the group of ir- 
rational divisors on C by the group of A"-rational principal divisors, while Pic((7) K 
is the group of if-rational divisor classes. It follows from Hilbert's Theorem 90 that 
the obvious map Pic(C) — > Pic((7) Gfc is injective. In general, however, it is not 
surjective. To measure this failure one is naturally led to use Galois cohomology. 
The Picard group is defined by the exact sequence 

1 -> K x -> k(C) x -> Div(C) -> Pic(C) -> . 

Taking Galois invariants, this sequence may no longer be exact. One can deduce 
an exact sequence 

-> Pic(C) -> Pic(C , ) GA " Br(K) , 

where Br(i^) denotes the Brauer group of K. The map 8c gives the obstruction to 
a A'-rational divisor class being defined by a i^-rational divisor. 
Following I17| we define the obstruction map 

Ob„ : Yl l {K, E[n]) -> Bt(K) 

by Ob„(^) = <5c(S), where (C, H) is any torsor divisor class pair representing the 
class £ € H 1 (i<r, From this definition we obtain the fundamental property of 

the obstruction map that the Brauer-Severi diagram corresponding to an n-covering 
(C, p) gives a model for C as a genus one normal curve of degree n in P™" 1 if and 
only if Ob n ((C, p)) = 0. Conversely, any genus one normal curve C —> P n_1 of 
degree n, together with a structure of torsor under its Jacobian E determines a 
unique isomorphism class of n-coverings of E with trivial obstruction. 

Using a result of Zarhin [47] O'Neil has shown [30] that the obstruction map is 
a quadratic form. This means that, for any integer a, Ob n (a£) = a 2 Ob„(£) and 
that the pairing 

(£, O Ob„(£ + £') - Ob n (0 - Ob n (e') 

is bilinear. The pairing is in fact the cup product associated to the Weil pairing on 
E[n], i.e. the composition 

U„ : H 1 (A',^[n])xH 1 (AT, E[n\) H 2 (A', E[n]®E[n\) ^ U 2 (K,p, n ) ~ Br(A)[n] . 

Using the compatibility of the Weil pairings of levels mn and n (where m, n > 2 
are integers not divisible by the characteristic of K) and the fact that the bilinear 
form associated to the obstruction map is the Weil pairing cup product one can 
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prove that the following diagram commutes. For details see p~3l Proposition 6]. 
(3.2) H l {K,E[m]) -^R\K,E[mn]) -^^R l (K,E[n]) 



Ob„ 



Ob„ 



Ob„ 



Br(K)[m] ^ Br(K)[mn] — - — ^ Bi(K)[n] 

Let C be a genus one normal curve of degree n defined over K with Jacobian E. 
We would like to extend the obstruction map to the set Cov' m ' (C/K). To do this, 
fix a map p : C — > E making C into an n-covering of E. If (U,7r) € Cov (m) (C/K) 
is an m-covering of C, then composing the covering maps gives D the structure of 
an mn-covering of E. This gives a map, depending on both C and p, 

* p : Cov {m) (C/K) 3 (D,tt) i-> (D, P ott) E Cov ( " m) (£/#) = H 1 ^, E[mn]) . 

Composing this with the obstruction map yields a map 

Ob m „ : Cov {m \C/K) % l£(K,E[mn]) °H" Br(K) , 

which we also denote by Ob mn . Since p is uniquely determined up to an automor- 
phism of E, the set in the following definition depends only on the equivalence class 
of C as a genus one normal curve of degree n (and not on the additional choice for 
the torsor structure). 

Definition 3.3. We say that an m-covering tt : D — > C has trivial obstruction if 
its image under Ob mn is trivial. We use 

Cov^ (C/K) := {(D,n) e Cov^ (C/K) : Ob mn ((D,n)) = 0} 

to denote the set of isomorphism classes of m-coverings of C with trivial obstruction. 

Our initial interest in this subset of coverings is justified by the following lemma. 
This is essentially a result of Cassels [6j Theorem 1.2]. 

Lemma 3.4. Let C be a genus one normal curve of degree n over a number field 
k. Then for any m > 2, Sel {m) (C/k) is contained in Cov[, m) (C/fc). 

Proof: If D is a smooth, projective and absolutely irreducible curve over a 
field K and D(K) ^ 0, then Pic(L>) = V\c(D) Gk . From the exact sequence 

Pic(D) -> Pic(D) Gk ^ Br(K) it follows that an m-covering tt : D -> C has 
trivial obstruction if D(K) ^0. If K = k is a number field and D is everywhere 
locally solvable, then this is the case everywhere locally. The local global principle 
for the Brauer group of k then implies that Pic(D) = Pic(D) Gk . In particular, the 
elements of the m-Selmer set of C (resp. m-Selmer group if C = E) have trivial 
obstruction. □ 

We now consider the case when m = n. When Cov^ n \C/K) is nonempty, it is 
a principal homogeneous space for B 1 (k,E[n\). The action of a class represented 
by a cocycle £ on a covering D is given by twisting. We use to denote the twist 
of D by £. Both D and £ have canonical images in H 1 (fc, E^n 2 ]) and the action of 
twisting coincides with the group law there. Namely, the image of is the sum of 
the images of D and £. The following lemma identifies how the obstruction changes 
under this action. 



12 BRENDAN CREUTZ 

Lemma 3.5. For D e Cov (n) (C/A") and £ e H 1 ^, E[n\) we have 

0b„2(D e ) = CU n £ + 0b n2 (£>), 

where U n denotes the cup product associated to the Weil pairing of level n. 

Proof: For the proof, we identify D, Dj and £ with their images in H 1 (i^, i?[n 2 ]). 
We know that Ob„2 is quadratic and that the associated bilinear form is given by 
U„2 . This means that 

D U n 2 £ = Ob„ 2 (D e ) - Ob„ 2 (£>) - Ob„2 (0 . 

The compatibility of the obstruction maps of different levels demonstrated by (j3.2[> 
shows that Ob n 2(£) = 0. On the other hand, the Weil pairings of levels n 2 and n 
satisfy the compatibility condition (see [101 III.8] ) : 

for all S £ E[n 2 ] and T e E[n] , e„2 (5, T) = e^raS, T) . 

For the cup product on the left-hand side above this means 

DU„ 3 £ = (n*£>) U n £ = CU n £, 

which completes the proof. □ 

We use C 1 - to denote the annihilator of C with respect to U n , i.e. 

C ± = UeH 1 ( J fC, J B[n]) : CU n ^0}. 

Corollary 3.6. T/ie set Covg™' (C / K) is either empty or is a principal homogeneous 
space for C 1 - C H 1 (K, E[n]). 

Proof: This is clear from the lemma and the fact that the action of H 1 (if, E[n]) 
on Cov^ (C / K) is compatible with the group law in H 1 (X, E[n 2 )) □ 

The following lemma gives an alternative characterization of Covq"'' (C / K ) which 
will be fundamental to our construction of the descent map in Section 

Lemma 3.7. Let C be a genus one normal curve of degree n with set of flex points 
X and let (D,ir) G Cov^ n \C/K). Then (D,ir) has trivial obstruction if and only 
if there exists a model for D as a genus one normal curve of degree n 2 in P" _1 
defined over K with the property that the pull-back of any x £ X by n is a hyperplane 
section. 

Proof: Fix isomorphisms ipr> ■ D —> E and 4>c '■ C — > E (defined over K) and a 
covering map p : C — > E such that the diagram 




commutes. Then X = p~ 1 (0e)- By definition (D,n) has trivial obstruction if and 
only if ifj£>(n 2 [0E]) is linearly equivalent to some if-rational divisor. On the other 
hand, D admits a model as in the statement of the lemma if and only if it* [x] is 
linearly equivalent to some if-rational divisor, for each x G X. It thus suffices to 
show, for all x £ X, that ij)* D (n 2 [QE\) and ir*[x\ are linearly equivalent. For this 
we may work geometrically. The problem is then equivalent to showing that for 
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any n-torsion point P £ E[n], the pull-back of P under the multiplication by n 
isogeny is linearly equivalent to n 2 [0 e] ■ This follows from the well-known fact that 
two divisors on an elliptic curve are linearly equivalent if and only if they have the 
same degree and the same sum. Indeed, the divisors in question both have degree 
n 2 and sum to 0^ in the group E(K). □ 



3.3. Composite coverings. Let m,n > 2 be integers not divisible by the char- 
acteristic of K and let (C, p) be an n-covering of its Jacobian E. There is a short 
exact sequence: 



(3.3) -> E[m) -> E[mn] ™ E[n] -> 

This gives rise to an exact sequence of Galois cohomology groups: 

( 3 - 4 ) i K\K,E[m\) h K\K,E[mn]) ^ K\K,E[n]) . 

mh (K ) [mn\ 

Recall the map * p : Cov (m) (C/iT) YL l {K,E[mn]) given by composing covering 
maps. 

Lemma 3.8. The image of the composition 

Cov (m) (C/K) U l {K,E[mn]) — > H 1 (K, E) [mn] 

is equal to { D £ H 1 (if, E)[mn] : raD = C} . Suppose further that K is a number 
field and C is everywhere locally solvable. Then the image of the composition 

Sel (m) (C/K) Se\ {mn) (E/k) — > \R{E/k)[mn] 
is equal to { D £ Ul(E/k)[mn] : mD = C } . 

Remark: From the exactness in (13.41) one sees that the fibers of ^ p are param- 
eterized by the finite group m g(K)[m7i] • ^ n ^ s wa y one re duces the study of 
mn-coverings of E to the study of m-coverings of the n-coverings of E. When 
m and n are relatively prime, the sequence (|3.3j) splits and so H 1 ^, E[mn\) ~ 
^(KjElm]) xH'fJf^Jn]). In this way one can further reduce the problem to the 
study of n-coverings where n is a prime power. In particular, to do an n 2 -descent 
on an elliptic curve E for some square free n it suffices to do p-descents on E and 
then compute the p-Selmer sets of the elements of the p-Selmer group for the primes 
p dividing n. 



3.4. Notation for the sequel. In the remainder of this paper we specialize to the 
following situation. We consider a p-covering p : C — > E where p is an odd prime 
and, unless expressly stated otherwise, make the following assumptions on C. 

• Pic(C) = Pic(C') GK , i.e. every X-rational divisor class can be represented 
by some if-rational divisor. 

• Cov (p) {C/K) ^ 0, i.e. there exists a p-covering of C defined over K. 

These assumptions are satisfied when K is a number field and C is everywhere 
locally solvable. The first is a result of Cassels [6] Theorem 1.2]; it is a consequence 
of the local-global principle for the Brauer group of K. The second is a result 
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of Tate (appearing in the same article of Cassels, Lemma 6.1). It is ultimately a 
consequence of the local-global principle for H 1 (_ftT, E[p\). 

From the first assumption above it follows that (G, p) has trivial obstruction. 
The Brauer-Severi diagram corresponding to (G, p) gives a model for G as a genus 
one normal curve of degree p in P p_1 . We fix defining equations of the following 
form. For p = 3, G C P 2 is defined by the vanishing of some ternary cubic form 
U(ui, U2,us) £ K [m, U2, U3]. For larger p, the model is as a (noncomplete) intersec- 
tion of pip — 3)/2 quadrics Qi(ui, . . . ,u p ) £ K[ui, . . . ,u p ]. We denote the G^-set 
of flex points on G by A. The corresponding etale A-algebra, Map^(A, A) will be 
denoted by F (for /Zex algebra) . 

4. Affine structure 

4.1. Affine Maps. We maintain the notation laid out in Section [3T4l Since X is 
a A-torsor under A[p], we may consider it to be the affine space underlying the 
2-dimensional F p -vector space E[p\. The action of Gk on X factors through the 
affine general linear group, which is an extension of the general linear group by the 
group of translations: 

1 -> E[p] -> AGL(A) -> GL(£7[p]) -> 1 . 

Here £7[p] acts on A by translations and GL(£7[p]) acts on E[p] in the obvious way. 

In general, if V, W are vector spaces and A denotes the affine space underlying 
V, then a map <f> : A — > W is said to be affine if, for all x £ A and P,Q£ V, one 
has 

<f>(x + P + Q) + <j>ix) = <j>ix + P) + <f>(x + Q) . 
Geometrically, this says that the sums of the values of <f> on the two pairs of opposite 
vertices of any parallelogram in A are equal. In characteristic different from 2 it 
is easy to check that a map is affine if and only if this condition is satisfied for all 
degenerate parallelograms where one pair of opposite vertices coincide. In other 
words, 

(4.1) cj) is affine <^ Vi £ A , P £ V, tj>{x + P) + <f>{x - P) = 2(f>{x) . 

We define Aff (A, W) to be the vector space of affine maps from A to W. Given 
an affine map 4> £ Aff (A, W) and x £ A, we can obtain a linear map A^^ : V — > W 
by projecting onto the linear part. This is defined by A^ >a; (P) = <j)(x + P) — <l>(x). 
One can easily check that A<^ x is linear and does not depend on the choice for x. 
This gives rise to a surjective linear map Aff (A, W) 9^4 A.$,x S Hom(V, W), 
which fits in an exact sequence 

W -> Aff (A, W) -4 Hom(y, W) -> . 

Now return to the case V = E[p] and A = X. We consider p, p as an ¥ p - vector 
space written multiplicatively. It naturally embeds in Aff (A, p, p ) as the subspace 
of constant maps. The group Aff (A, p p ) itself may be identified with a subgroup 
of Map(A, K). As such it inherits a natural action of Gk- We have a short exact 
sequence of Gj<--modules 

(4.2) 1 n P -> Aff(A,^ p ) Hom(E\p],n P ) ^0. 

The G^-module E[p] is self-dual via the Weil pairing. Namely, we can identify E[p] 
with Horn (£7 [p], p p ) via 

E[p] 3P4 e p (P, -) £ Rom(E\p],ix p ) . 



SECOND p-DESCENT 



15 



Remark: Alternatively, one can make this identification using P ■<-» e p (—,P). 
Since the Weil pairing is alternating, the two differ by a sign. This controls the 
factor of — f in the next lemma. We have made our choice in deference to the 
formulation of Proposition 15.31 below. 

Making this identification in the exact sequence (14. 2[) above and taking Galois 
cohomology we obtain an exact sequence 

(4.3) K l {K,ii P ) H 1 ^, Aff(A,,i p )) ->■ R l (K,E]p]) A Bv{K)\p] . 

Here we have also identified H 2 (if, p p ) with the p-torsion in the Brauer group of 
K. Recall that C 1 - is the subgroup {£ G H^JT^fp]) : CU P £ = 0}. The next 
lemma identifies this with the kernel of T. 

Lemma 4.1. T(£) = -C U p f . 

Remark: We may consider Cov^ p \C/K) as the affine space underlying the F p - 
vector space H (K, E[p\). With this interpretation the obstruction map Ob p 2 : 
Cov (p) (C/K) -> Br{K)[p] is affine, as one can see from Lemma 13.51 Lemma 14.11 
identifies T (up to sign) as the corresponding linear map obtained by projecting. 

Proof: Recall that p : C —> E denotes the covering map. Let ip : C — > E be 
an isomorphism (defined over some extension of K) such that p o -0 = p. For 
any a £ Gk, the map ip" — ip corresponds to translation by an element of E[p\. 
This defines a cocycle representing the class of C in H (if, S[p]). The cup product 
— C U p £ is the class of the 2-cocycle 

G K x G K 3 ((J, t) t-> e p {rj) - ip T , £) £ p p . 

Now let ^eH 1 ^,^]). T is a connecting homomorphism, so to compute T(£) 
we first choose a lift of £ to a cochain with values in Aff (X, p, p ). For any P £ E[p], 
we claim that the map (pp :I3ii-) e p (P,ip(x)) £ p p is affine and that its image 
under Aff (Jf, p p ) — > E[p] is P. To see that it is affine, let x £ X and Q,R £ E\p]. 
Using bilinearity of the Weil pairing we have 

4> P {x + Q + R)- <f>p(x) = e p (P, ip{x + Q + R)) ■ e p {P, ip(x)) 
= e p (P, iP(x) + Q + R)- e p (P, i/>(x)) 
= e p (P, iP(x) + Q) ■ e p (P, i>{x) + R) 
= 4> P (x + Q) ■ 4> P (x + R) . 

The image of (pp in Hom(£'[p], p p ) is given by projecting onto the linear part. This 
is the map 

R i ^ <j>p(x + R)/<p P {x) = e p (P, iP(x) + R)/e p (P, ^{x)) = e p (P, R) . 

The identification of E[p] with Horn (i?[p], p p ) is given by 

E[p] 3 P o e p (P, -) g Rom(E\p], n P ) , 

so the image of (f)p in E[p] is P. 

Thus T(£) is given by the coboundary of the cochain a h-> e p (£ CT , %p) — e p (—ip>, £ CT ) £ 
AS(X,p p ). Here e p (— ip, is the map x H> e p (— ip(x), £ CT ). The value of the 
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coboundary on a pair (a, r) £ Gk x G/f is given by 



e P (-V>,£<rr) e p (-ip,&) 
This is the same as the cup product computed above, so the lemma is proven. □ 

4.2. Making cohomology groups explicit. We have identified C 1 - with the 
kernel of T. By exactness of the sequence (|4. 3[) defining T, this is the same as the 
image of H 1 (X, Aff(A, fi p )) in H 1 (if, -E[p]). This suggests that we should look for 
a practical description of H 1 (A", Aff (X, (i p )). 

Recall that F denotes the flex algebra, M&p K (X, K), and that [i p (F) — Map(A, fi p ). 
We have a canonical monomorphism AS(X,fi p ) fj, p (F); this is simply the obser- 
vation that an affine map is a map. To obtain a description of H 1 (A, Aff (X, fi p )) 
we want to extend this to a short exact sequence and take its Galois cohomology. 
To do this, we want to write down a morphism on fi p (F) whose kernel is Aff (A, /x p ). 
We can achieve this by identifying a suitable Gx-set derived from X and taking 
the induced norm map described in Section [2J A Gi<--set derived from X is just 
a Gk -stable set of divisors on G that are supported entirely on X. This and the 
characterization of affine maps in (|4.1I) motivates the following lemma. 

Lemma 4.2. The set of divisors of the form (p — 2)[x] + [x + P] + [x — P] £ Div(G), 
with i£l and P £ E[p], is a GK~stable set of hyperplane sections of C. 

Proof: The fact that these divisors form a G^-set follows from the fact that 
the action of E[p] on X is Galois equivariant. To see that they are hyperplane 
sections, we may work geometrically, considering G as an elliptic curve with some 
flex xo £ X as distinguished point. Note that the flex points are then the p- 
torsion points on the elliptic curve (C,xq). Since the model for G is given by 
the embedding corresponding to the complete linear system |p[xo]|, the hyperplane 
sections are precisely those divisors linearly equivalent to p[x ]. That the divisors 
in the lemma are hyperplane sections is then a consequence of the well-known fact 
that two divisors on an elliptic curve are linearly equivalent if and only if they have 
the same degree and the same sum. □ 

We use Y to denote the set of hyperplanes in Lemma 14.21 It is a Gk -set and we 
denote its corresponding etale A-algebra by H (for hyperplane algebra). Note that 
Y is derived from X in the sense described in Section |2~T1 Using (14.11) we see that 
the induced norm map d : F — > H yields an exact sequence 

(4.4) 1 -> Aff(A, fi p ) ^F x AjJ x . 

This allows us to obtain the desired description of H 1 (A, Aff (A", fip)). 

Lemma 4.3. 

(dF x ) GK 
U\K,AS(X^ p ))c { gF > x . 

Proof: We have an exact sequence 

1 -> Aff (A, ^ -> F x A dF x -> 1 . 

By Hilbert's Theorem 90, H 1 (A, F x ) = 0. The result follows by considering the 
long exact sequence of Galois cohomology groups. □ 
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Corollary 4.4. There is an isomorphism C ~ (dF x ) Gk /K x dF x , where we 
identify K x with its image in H x . 

Proof: Lemma |4~T1 shows that is isomorphic to H 1 (i4r, Aff (X, /i p )) modulo the 
image of H (if, fi p ). Lemma l4~3l and Hilbert's Theorem 90 allow us to identify these 
groups with {8F x ) Gk / dF x and K x /K xp , respectively. We only need to show that 
the identifications are compatible. 

Noting that K C F = Map(X, K) consists of the constant maps we see that for 
a £ K, d(a) = a p £ K C H . This shows that the following diagram commutes: 



1 



K x 



A8(X,Hr) 



F> 



■dF> 



The identifications are made by taking Galois cohomology and using that, by 
Hilbert's Theorem 90, H (if, — ) of the middle terms vanish. From this compat- 
ibility is clear. □ 



Before proceeding we fix some notation. As a G^-set, Y splits as a disjoint union 
of (at least) two G^-stable subsets. The first consists of the p 2 hyperplane sections 
of the form p[x] with x £ X. These divisors correspond to pairs (x, P) with P = 0. 
The other consists of those y £ Y associated to some pair (x, P) with P^O. These 
two Gi<--subsets will be denoted by Y\ and Y2 ; their corresponding etale if-algebras 
will be denoted by Hi and i?2- As Gk -sets, X and Y\ are isomorphic and so we will 
identify F with Hi. Thus H splits as H ~ Hi x H2 — F x H^- Correspondingly we 
have a splitting of the induced norm map as d = d\ x 82 with di : F 3 a H> a p 6 F. 

For p = 3, Y2 consists of the 12 lines of P 2 that pass through three distinct flex 
points of C. For p > 5, X x anc | y 2 are isomorphic as G^-sets, a pair (x, P) 

corresponding to the hyperplane section (p — 2) [x] + [x + P] + [x — P] . From this we 
see that = p 2 {p 2 — l)/2. There is a canonical projection F 2 9 (x, P) M> x e X. 
Thus, for p > 5, H2 may be viewed as an F- algebra of degree (p 2 — l)/2. 



5. The descent map 

Recall (Corollary 13. 6|) that Covq(C/K) is a principal homogeneous space for 
C . We have obtained a more or less concrete description of as a subgroup of 
H x / K x OF x . The goal now is to give an equally explicit description of Cov^ (C/K) 
as a coset of C inside H x / K x dF x . This will be achieved by our descent map. 

Let [x] £ Div(G <E>k F) = Ma,p K (X, Div(G)) denote the map whose value at 
x e X is the divisor [x]. Similarly we use [y] to denote the element of Div(G <E>k 
H) = Ma,p K (Y, Div(G)) whose value at y £ Y is the divisor y £ Div(G). By Lemma 
14.21 the divisors in Y are all hyperplane sections of G. Thus we can choose a linear 
form I £ H[u±, . . . , u p ] cutting out the divisor [y]. We then choose any linear form 
u £ K [u\, . . . , Up] cutting out a divisor on G that is disjoint from X to obtain a 
rational function I — i/u £ k(C (8) k H) x with 



div(£) = [y] - div(u) 
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Proposition 5.1. The function £ induces a unique homomorphism 

$ : Pic(C) ->■ H x /K x dF x , 

with the property that the image of any divisor class is given by evaluating £ at any 
K -rational representative with support disjoint from X and div(u). 

Proof: This follows directly from Proposition 12. II □ 

Recall that we have assumed Pic(C) = Pic(C) Gk . Identifying Pic 1 (C) with 
C(K) we can think of $ as giving a map on the X-points of C. For the points 
outside X and div(it), this is simply given by evaluating £. Note also that the 
homomorphism does not depend on the choice for u. So if we like, we may determine 
the image of a point by evaluating £ on some choice of homogeneous coordinates. 
For this reason we may refer to £ as the linear form defining the descent map in the 
following theorem. 

Theorem 5.2. The choice of linear form £ determines a unique well-defined map 
( called the descent map ) 

$ : Cav^fC/K) -^H X /K X 8F X 

with the following property. If (D,tt) £ Covq^ (C/K) and K C L is any extension 
of fields with Q 6 D(L), then 

$((£>, ?r)) = *(?r(Q)) modL x dF L x . 

In particular, if D(K) ^ 0, then <&((D, 7r)) is the image of some K-rational point 
of C under $. 

Remark: Recall that Covq (C/K) yields a partition of the i^-rational points of 

C, 

C(K) = H n(D(K)) . 

(D,7r)eCov^ } (C/K) 

The defining property says that $ : C(K) — > H x / K x dF x is constant on each of 
the sets appearing in this partition and that the value on each is equal to the image 
of the corresponding covering under the descent map. 

Proof: Let (D,w) G Cov^ (C/K). By Lemma[3J] we have a model for (D, tt) as 
a genus one normal curve of degree p 2 in P p _1 = P p ~ 1 {z\ : ■ ■ • : z p z), where tt is 
defined by homogeneous polynomials, 7r^ € K\z\, . . . , z v i\ and the pull-back of any 
flex point x on C is a hyperplane section \\ x of D. For any x, \) x can be defined 
by the vanishing of some linear form h x £ K[z\, . . . , z p i\. Moreover, we can choose 
these h x to form a Galois equivariant family. Thus they may be patched together 
to obtain a linear form h € F[z\, . . . , z v i\ cutting out the divisor it* [x] on D ®k F. 

Since the zero divisor of £ is [y] = d[x] £ Div(C ®k H) we see that dh and 
£o tt cut out the same divisor on D. It follows that the rational functions £ott and 
dh I u o it have the same divisor. Hence there exists some A e H x such that 

(5.1) £ o tt = A ■ ( ———) in k(D ®k H) x • 

\U O TT J 

We define the image of $((D,7r)) to be the class of A e H x /K x dF x . 
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A different choice of forms defining tt would change the left-hand side of ([5.1J 
by a factor in K x . Similarly, a different choice for the form h = (h x ) x eX defining 
(*)x)xex would change the right-hand side of (|5.1I) by a factor in dF x . Thus, having 
fixed the model for (D, tt) in P p _1 we get a well-defined element of H x / K x dF x . 

Let us show that this does not depend on the model. Suppose (D' , tt') is isomor- 
phic to (D, tt), and choose a model for (D', tt') in F p _1 as genus one normal curve. 
As above, choose a linear form h! £ F[z\, . . . , z p z] cutting out the divisors 7r'*[x] 
on D' . By assumption we have an isomorphism of coverings ip : D' — > D defined 
over K (i.e. such that tt' = tt o ip). Let ip* : k(D ®k H) — > k(D' ®k H) denote 
the isomorphism of function fields induced by ip. Applying ip* to equation (|5.1I) . 
we obtain a relation in k(D' ®k H), 

(5.2) A • ( d ( h °V) \ =(p *( A . ( -^L]) =ip*{toTT) = £oTTOtp = £ott' . 

\ U O 7T J \UO TT J 

The divisor on D' cut out by h o ip is tt'* [x] , so the extremal terms in (|5.2p define 
the image of (D', tt') under the descent map. Thus the image of (D' ,tt') is also the 
class of A, which shows that $ is well-defined. 

It remains to show that <t has the stated property. For this let Q € D(L) 
be a point defined over some extension L of K. We can find an L-rational divisor 
d = riiQi on D linearly equivalent to [Q] and such that the support of d contains 
no points lying above the flex points of C or the zeros of u. The divisor [7r(Q)] on 
C is linearly equivalent to the //-rational divisor n^d :— Yli^i^iQi)] ( e -§- EH1 
II. 3. 6]). So $(7r(Q)) is represented by £(7r*d). On the other hand, the relation (|5.1J 
defining A gives, 

tM = A • ( — ) (d) , 

since deg(d) = 1. Now since d is /-rational, (d) e L x dF£. So $(tt(Q)) is 

represented by A as required. □ 

In what follows we will refer to a linear form h £ F[zi, . . . , z p i\ as in the proof 
(i.e. such that 7r*[x] = div(h)) as a linear form defining the pull-back of a generic 
flex. Recall that I is defined as the ratio I = I/u. If (D,tt) £ Cov^ (C/K) and h 
is a linear form defining the pull-back of a generic flex (on some model of (D,7r)), 
then the image of (D, tt) under the descent map is also represented by the A £ H x 
satisfying the relation 

Ion = Adh 

in the coordinate ring of D. 

5.1. Injectivity of the descent map. The following proposition shows that the 
descent map respects the affine structure. 

Proposition 5.3. Let (D,tt) £ Covjf 5 (C/K), (eC 1 and (D, tt) ■ £ be the twist of 
(D, tt) by £. Then 

$((£>, tt) • = H(D,tt)) ■ # (0 € H X /K X 8F X , 

where $0 : C 1 - ~ (dF x ) GK /K x dF x is the isomorphism given by Corollary \4-4\ 

Recall that C ± acts simply transitively on Covi (C/K) by twisting. The propo- 
sition shows that the image of C ± under $0 acts on the image of Cavfi (C/K) under 
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$ by multiplication and that the pair (<l, $o) respects these two actions. Since 5>o 
is an isomorphism, we deduce the following. 

Corollary 5.4. Assume CoVq (C/K) is nonempty. Then the descent map is an 
affine isomorphism (i.e. isomorphism of principal homogeneous spaces). In par- 
ticular $ : Cov q P ' (C/K) — > H x I K x dF x is infective, and its image is a coset of 
{dF x ) GK /K x dF x inside H x /K x dF x . 

Before giving the proof, it will be useful to put together a diagram. For any 
.to € X and P £ E[p], the Weil pairing on E[p] gives a map 

4>p.x '■ x 3 x H- e p (P, x - x ) e [i p , 

where x — xq denotes the unique Te E[p] such that xq + T = x. A different choice 
for xq gives a map which differs by a constant factor. Thus, the image of 4>p,x in 

Hp(F)/ii p = Map(A, /{constant maps} 

depends only on P. Nondegeneracy of the Weil pairing shows that distinct choices 
for P lead to distinct maps. Thus we have an embedding E[p] /i p (F)//x p . 

Recall that the kernel of d\p x is the space of affine maps to Since di is 
just the p-th power map, the space of affine maps is also equal to the kernel of 
^\fj, p (F)- Since the constant maps are affine, d 2 induces a map on (i p (F)//i p . For 
any P £ E[p] and xq € X, the map <t>p,x 1S affine (cf. the proof of 14. f p . Now, by 
counting dimensions for example, we see that the sequence 

-► E[p] -+ fi p (F)/fx p A M#2) 

is exact. 

We also have an exact sequence 

f -> AS(X,n P ) -> Mp (F) A M P (ff 2 ) . 

We claim that the two are compatible in the sense that following diagram commutes. 
The map Aff(X, fi p ) — ¥ E[p] is given by projecting an affine map onto its linear 
part and then identifying E[p] with its dual using the Weil pairing (so the vertical 
sequence on the left is (|4.2j) . considered in the discussion leading up to Lemma l4~Tj) . 

(5.3) f f 



Hp : 



1 Aff(X, fi p ) fi p (F) d 2 (fi p (F)) f 



E 



p] 



1 
Note that the rows and columns are exact. 
Lemma 5.5. Diagram i5.S\) commutes. 
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Proof: We only need to show that the lower-left square commutes, the rest being 
obvious. Let tf> : x i— > cj>(x) be an affine map. Choose some xo € X. Projection 
onto the linear part is the map : P H ► cj>(xo + P)/4>{xo). Identifying E[p] with 
its dual via the Weil pairing, is the unique R £ E[p] such that, for all P £ E\p], 
(j>(xo + P)/(f>(xo) = e p (R,P). The image of this R in fip(F)//j, p is the class of the 
map 4>r,x '■ x i — y e p (R,x — xq). By the property defining _R, this is equal to the 
map x >• 4>(xq + (x — xq)) / <p(xo) = (f>(x)/(p(xo). Modulo constant maps, this is the 
same as the image of <j) in fi p (F), so the diagram commutes. □ 

For the proof of Proposition 15 . 31 we will make use of an alternative description 
of the embedding E[p] » n p (F)/n P . 

Lemma 5.b. Let D £ Cov { p] (C/K) (nb: over K, not K) and let h denote a linear 
form (with coefficients in F) defining the pull-back of the generic flex point on C . 
For any R £ E[p], the image of R under the composition E[p] =— ^ fi p (F)/fi p 
F x /K x is equal to the class of h ^Q^ , where Q £ D is any point chosen so that 
h(Q) and h(Q + R) are both defined and nonzero. 

Proof: Let ip : C — > E be the isomorphism (defined over K) such that p o ip = p 
and let xq be a preimage of Ob under tp. Further, let Qo be any preimage of xq on 
D and ipD ■ D — > E be the isomorphism defined (over K) by Q i— > (Q — Qo). Wc 
have a commutative diagram, 

eJ^d 



E* C 

i> 

If a; is a flex point, evaluating the coefficients of h at x gives a linear form h x 
defining the pull-back of [x] by n. Consider the function h x /h Xo £ k(D) x and its 
image g x = (^YiK/h^) £ k(E) x . The divisor of h x /h XQ is t:*[x\ - 7r*[a;o], so 
by commutativity &iv(g x ) —p*[(x — xq)] —p*[0e}- By definition of the Weil pairing 
gQlIII.8], for any ReE\p], 

e p (R, x - x = 7—— , 

9x{T) 

where T £ E is any point chosen so that both numerator and denominator are 
defined and nonzero. Thus, we have 

/ lx (^ 1 (T) + J R)/ lxo (^ 1 (T)) 



(5.4) e p (R 7 x — xq) 



h x {^{T))h X0 ^- D \T) + R) 



Considered as an element of F x — Map(A, K x ) modulo the constant maps, the 
right-hand side of (|5.4I) is represented by the map 

h^ D \T) + R) _f h x (V^ 1 (T) + R) 



h(^\T)) \ X " h x ^ D \T)) 

On the other hand, the left-hand side of (|5.4|) represents the image of R in ti P {F) / /i p , 
so we are done. □ 
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Proof of Proposition [5731 Let (D,ir), (D^,tt^) and £ be as in the proposition, 
and fix models for everything in P p _1 . We have an isomorphism (of coverings) 
p : — >• D defined over K, with the property that <p a (Q) = <f(Q) + £o- f° r au 
Q G D% and a G G K - 

Choose linear forms h and h% with coefhcients in F defining the pull-backs of 
the generic flex by ir and ir^, respectively. For some A,Aj G i/ x , necessarily 
representing the images of (D,ir) and (D^,tt^) under we have 

A • dh = I o 7r and A^ • i%£ — £o tt^ 

in the coordinate rings of D and D% , respectively. Applying p* to the first relation 
and comparing with the second gives 

A • d(h o tp) = A 5 • dh 6 

in the coordinate ring of Dg. Specializing to a point Q in not lying above any 
flex point of C (i.e. so that neither nor hop vanish at Q) we have 

Note that h^{Q) and h(ip(Q)) depend on a choice of homogeneous coordinates for 
Q, but that their ratio does not. This is G^-invariant since A and A^ are in H x . 
Under the isomorphism (8F x ) Gk /dF x ~ R 1 (k,AS(X,n P )) given in Lemma [4.3[ 

^( ^wf ) corresponds to the class of the cocycle 

which a priori takes values in Aff (X, C fj, p (F). We need to show that the image 
of this cocycle under the map induced by AS(X, /i p ) — ► E[p] is cohomologous to £. 
For this we make use of the following commutative diagram 

(5.5) Aff(X,M P ) c ^M P (^) C ^ x 



E 



pf ^ P (F)/^ F*/K> 



Since the horizontal maps are all injective, it will be enough to show that, for any 
a 6 Gk j the images of £ CT and r\ a in the lower- right corner are equal. For this we 
will make use of the preceding lemma. 

Using the fact that h and are defined over H and rearranging, we have 



h(p°(Qn)\ ( k(Q) 



h(p(Q)) J V^(Q CT ) 
Making use of the fact that p 17 (Q a ) — p(Q a ) + £ CT we can rewrite this as 



h(p(Q) + & + (y(Qn-v(Q)))\ fhdQ" + {Q-Q°)) 



h(p(Q)) ) V MQ° 

By Lemma 15.61 this represents the image of 

& + - <p(Q)) - (Q a - Q) g E[ P ] 
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under the embedding given by the bottom row of (|5.5j) . But 

MQ a ) - <p(Q)) - {Q a - Q) = Oe 

(see [101 X.3.5]) so the images of r\ a and £ CT in the lower right corner of (|5.5I) arc 
equal. From this the proposition follows. □ 

We can use a similar argument to prove the following useful lemma. This says 
that we could use I to perform descent on E = Jac(C). In practice, one is likely 
to have produced C by performing a descent on E, so this is not going to yield 
anything new. It does however allow us to relate the descent on C to the descent 
on E. 

Lemma 5.7. The following diagram is commutative. 

Pic°(C) ^^^^=^^^^= E(K) 



(0F > 



E\p]) 



K x dF x 

Here 8e is the connecting homomorphism from the Kummer sequence associated to 
E, and the composition of the bottom row is the map identifying (dF x ) GK /K x dF x 
with C x C H 1 

Proof: Let S £ Pic°(C) and choose a representative d € Div(C) whose support is 
disjoint from X and any zeros of u. Write d as a difference d = d\ — d2 of effective 
divisors and write each di as a sum d t — ^2'j = i Pi.j of n = deg(c?i) = deg(c?2) 

(possibly non-distinct) points on C. Now choose any (D,tt) £ Covq P '(C '/ ' K) and a 
linear form h with coefficients in F defining the pull-back of the generic flex. For 
each Pi j in the support of d, choose a point Qij £ D such that n(Qi,j) — Pij. 
These choices are such that, as points on E, 

p{Qi,j ~ Qi',j') — (Pi,j ~~ Pi',j') J 

for any i, j, In particular, pY^j=i(Qi,j ~ Q%,j) = d. So the image of S under 
the connecting homomorphism is given by the cocycle 

(n n \ 

E^u - Qh) ~ YSQi* ~ Q^) e E[ P ] . 

On the other hand, the image of S under <I> is represented by 

t(<h) f [ i(p 2 ,j) " 

Choose homogeneous coordinates for the which are compatible with the action 
of the Galois group (i.e. so that applying a to the coordinates of Pij gives the 
homogeneous coordinates for Pfj). The class of $(2) is then also represented by 

where £(Pij) now means evaluating the linear form on the given choice of homoge- 
neous coordinates for P^j. 
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In the coordinate ring of D (over H) we have I o 7r = $((£>, tt)) ■ dh. We can 
fix forms defining the covering map n and choose homogeneous coordinates for the 
Qij so that the equality ir(Qij) = Pij is also true for the coordinates chosen. Now 
since deg(d) = 0, we have that 

whereby h(Qij) means evaluating h at the given choice of coordinates. 

Under the isomorphism (dF x ) Gl< / K x dF x ~ H 1 ^, AS(X, n P ))/K x , $(S) is 
sent to the class of the cocycle 

a h- > a a /a , 

where a € F x is any element such that 9a represents The argument above 

shows we may take a = fll^=i T§^f~))- Hence, the image of S in H 1 (A", Aff(X, fi p ))/K > 
is represented by the cocycle 77 sending a 6 G/f to 



1 h a (Q%j) j \J = \ fc(Qu) 

Ji ^(Q 2 CT ,i) J ' ^/i M<2ij) 

Applying Lemma 15.61 as in the proof of the proposition, to each factor appearing, 
we see that the image of r\ a in H 1 (i^, E[p\) is equal to the class of the cocycle 

n 

G K 3 a -> J] ((Qij ~ QSj) - ((Ou - Oaj)) G £7[p] . 
3=1 

This is the same as the image under the connecting homomorphism, so the diagram 
commutes. □ 



5.2. Image of the descent map. From here on use Hk to denote the image of 
Cov^ (C/K) under the descent map and H° K for {8F x ) Gk / K x dF x . We know 
that Hk is a coset of H° K inside H x / K x dF x . Recall also that Corollary 14.41 gives 
an isomorphism C ~ %k- 

In practice one prefers to work with representatives in H x . We set H° K — 
(0F x ) Gk C H x . To achieve the same for Hk, let P € C(X) be any point that is 
neither a flex nor a zero of tt. Define H K = (£{P) ■ 8F x ) Gk . That this does not 
depend on the choice for P is shown in the proof below. 

Lemma 5.8. Hk = H K /K x dF x 

Proof: To show that Hk does not depend on P, let P' € C(K) be any point 
which is neither a zero nor a pole of £ Choose (D,tt) e Cov^ (C/K) ( nb: over 
K, not X). Fixing a model for (D,ir) and choosing a linear form h defining the 
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pullback of the generic flex, we get a relation ton — A(dh/u o it) in k(D ® k H). 
Choosing points Q, Q 1 lying above P and P' we get that 



l(P)IKP') dh(Q) ' u{n - (^\ ■ 8 (^-) 
1 V 1 } ~ dh(Q>) ■ u{P) ~ \ u{P) ) {h(Q')J 



£ K X 8F X = 8F y 



It follows that the coset £(P) ■ 8F X does not depend on P. Hence neither does its 
Gk -invariant subset. 

Clearly if Hk is nonempty, then it is a coset of H K . So it will suffice to show 
that 

In Section |5] we show how to construct representatives for elements of Cov^\c / K) 
from elements of Hk, so we will assume Hk ^ 0. 

To show containment, let (D, n) £ Covq(C/K). Its image in Hk is defined by 
a relation in the coordinate ring of D of the form i o 7r = Adh. Evaluating at any 
point Q £ D not lying above a flex or zero of u, we see that A 6 ^(7r(Q)) • <9F X . 
But we know A is Galois invariant, so it must lie in (£(ir(Q)) ■ 0F x ) Gk = Hk- d 

For algebraic extensions the next lemma follows easily from the fact that Hk is 
defined by taking Gif-invariants. The value of this description is that it shows that 
non-membership in H,k is stable under base change. 

Lemma 5.9. Suppose that K' is an extension of K and A € H x is such that 
A®x 1 represents a class in Hk' ■ Then the class of A in H x / K x dF x lies in UK- 
Proof. The assumptions imply that in (H ® K K') x we have 

A 



1 = da . 



t[P) 

for some a £ (F ® K K') x ~ Y\ x&x K' x depending on P £ C(K). For x € X we 
have A X /£ X (P) (g) 1 = or x in K <S> K'. This shows that a x is algebraic over K, and 
hence lies in K. Thus a £ F and we have A = £{P)d(a) in H . This shows that A 
represents a class in %k- D 

The elements in %k satisfy certain norm conditions. These will be used in the 
algorithm presented in Section [7] 

Lemma 5.10. There exist c £ K x and (3 £ such that any (5,e) £ F x x ~ 
H x representing a a class in %k satisfies Nf/k(S) = c modK xp and 82(5) — fie p . 

Proof: To prove the existence of /3 £ i? 2 x we argue as follows. The divisor cut out 
by l\ is p[x], while that cut out by £2 is c?2[x]. So in the coordinate ring of C®k H2 
there is a relation 82(1-1) = fi£\, which determines j3 £ 7? 2 X . For the existence 
of c £ k x note that the divisor on C defined by N F / k (£i) is p times the divisor 
The divisor J2 xeX i x 1 1S itself cut out by some form g G K[u%, . . . , u p ] of 
degree p. Thus, there is some c £ K x , such that in the coordinate ring of C 

N P/K lx =c-g". 

It is clear from the definition of "Hk and Lemma 15.81 that these conditions carry 
over to Hk- □ 
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5.3. The main diagram. Let K-k be the finite group 
(5.6) K K 



ft 



(h° (k. 



ft 



H° (k, 



Taking Galois cohomology of diagram (|5.5I) we have the following. 

Proposition 5.11 (Main Diagram). T/ie following diagram is exact and commu- 
tative. 

1 1 



■K 



K 



o/O 



F x /K x F xp 



1 ^JC K ^B.\K,E\p\) 



Br(K)[p] 



R 1 (K,d 2 (fi p (F))) 



■■Bt(K)\p] 



Proof: The lower of the two rows is obtained directly from the long exact sequence 
of the bottom row of (|5.5|) . Up to the identifications described below, the upper 
row is obtained by taking Galois cohomology of the upper row of (|5.5[) and then 
modding out by the images of H 1 (K : fi p ). A completely formal diagram chase shows 
that the kernels of these two rows must be isomorphic (so that K-k is the kernel in 
the top row as well). 

The identifications are the obvious ones following from Hilbert's Theorem 90, 
Lemma 14.31 and Corollary 14.41 One can check that the map labelled p^ is in fact 
induced by projection of H ~ F x H 2 onto its first factor. This is obvious from the 
proof of 031 □ 



Remark: For p = 3, one can replace <9 2 „ : F x /K x F x3 — > R 1 (K , d 2 (/j, p (F))) with 
d 2 : F x /K x F x3 -> H X /H 2 P without affecting exactness (see QU Section II.6]). 

The relevant data for descent on C is contained in a translate of the top row. 
For any (S, e) 6 F x x H 2 ~ H x representing a class in Hk we have a commutative 
diagram: 

(5.7) 

Cov {p) (C/K) 



1 ^JC K ■ (S,e) 

1 K K 



K 



{ 5 € F x /K x F x p : d 2 (6) e (3H 2 xp } 



■(S,e) 



o/O 



pr 



\Se F x /K x F x p : d 2 (S) £ H 2 xp } 
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Lemma \b . 1 01 shows that the sets on the right contain ker((?2*) and its translate by 
5. So the lower row is an exact sequence of groups and the upper row is an exact 
sequence of pointed sets. 

6. Inverse of the descent map 

The main result of this section is the explicit construction of an inverse to the 
descent map. Recall that Hk C H x is the subset of elements which represent 
classes in the image of $ : Cov[, p) (C/K) -> H x /K x dF x . 

Theorem 6.1. Given A G Hk , we can explicitly compute a set of p 2 (p 2 — 3)/2 
linearly independent quadrics over K which define a genus one normal curve Da C 
P p _1 of degree p 2 and a set of homogeneous polynomials defining a map 7Ta : -Da ~~ ► 
C making -Da into a p-covering of C . Moreover, the image of the class of (-Da,tta) 
in Cov^\c I K) under the descent map is equal to the class of A in Hk- 

Remark: Our proof is strongly influenced by [I7J H, Section 3]. In that paper, 
the problem of obtaining models of n-coverings of elliptic curves with trivial ob- 
struction as genus one normal curves of degree n is considered. Their first step (in 
the 'Segre embedding method') is to embed the curve as a genus one normal curve 
of degree n 2 . They then show that, after projection to a suitable hyperplane, the 
embedding factors through the Segre embedding P" _1 x (P™ _1 ) v — s- P"" _1 . Mak- 
ing this factorization explicit requires an explicit trivialization of the obstruction 
algebra associated to the n-covering. 

In our situation, things are actually somewhat simpler. We start with a p- 
covering of C. The analog of the first step of the Segre embedding method above 
yields a model as genus one normal curve of degree p 2 . This already gives us 
what we are after. It is a feature of second p-descents that no trivialization of the 
obstruction algebra is necessary. 

Let A £ H x . Note that we are not yet assuming A € Hk- We can associate 
to A a C-scheme -Da defined over K as follows. Fix a basis {ei,...,e p 2} for F — 
Ma.p K (X, K) over K . We can then write an arbitrary element z € F as z — ^ z^. 
The choice of basis gives an identification of (F \ {0})/K x with the if-points of 
P p _1 , 7^ z = Ziei corresponding to the point (z\ : ■ ■ ■ : z p i) G P p _1 . 

We start with the equation 

£ = aAd{z) 

where a e K x and z e F\ {0} are treated as unknown. The map d : F —> H can 
be written as a homogeneous polynomial of degree p in the z, and so our equation 
corresponds to an equation 

i{u\, u p ) = aA<9(zi, z p ), 

where i and d are homogeneous polynomials of degrees 1 and p, respectively, both 
with coefficients in H . Writing this out in a basis for H over K (extending the 
basis chosen above) and equating coefficients on the basis vectors gives a system of 
m := [H : K] equations, with coefficients in K, of the form: 

(6.1) linear in Mi, Up = degree p in z\ z p 2 . 
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We claim that the matrix defined by the coefficients of the m linear forms in 
the left-hand side of (|6.1| has full rank (i.e. rank equal to p). For this one uses 
a geometric argument; over K, £ splits as a tuple of linear forms defining the 
hyperplanes in Y and these span the space of all linear forms in K[u\, . . . , u p \. 

Eliminating u\, . . . , u p gives a system of equations: 

( Ui = a • iri(zi, . . . , Zj?) , fbr£=l,...,p "I 
1 = a ■ Pi(zi, . . . , z p 2) , for i = 1, . . . , m — p J 

where 7Tj and Pi are homogeneous of degree p with coefficients in K. Let 

{Qj («!,..., Up) : j = l,...,N} 

be the homogeneous polynomials defining the model for C as a genus one normal 
curve of degree p in P p_1 . Recall that in the case p — 3, N = 1 and Q\ is 
of degree 3. For larger p, N = p ( p ~ 3 * 1 and the Qj are of degree 2. We define 
Da CP P : ••• : z p i) as the (reduced) if-subscheme defined by the vanishing 

of the polynomials in the set 

{Pi-. 0<i<m-p}\J{Q j (ir 1 ,...,Tr p ): < j < N} . 

The second set is included to ensure that the rational map 

¥ p2 - 1 {z l z p 2) -> P^ 1 ^ : • • • : Up) 

defined by m = -Ki (z% , . . . , z p i ) restricts to a morphism 7ta : -Da — > C. Note also 
that if A = A' modiir x , then (Da,tta) = (-Da',7Ta')- I n other words, (Z?a,7ta) 
only depends on the class of A in H x /K x . 

Remark: In the case p = 3, m = [H : K] = 21, so Z?a C P 8 is defined by 18 cubics 
and one form of degree 9. For p > 3, we have m = p 2 (p 2 + l)/2, so the model is 
given by p ^ P 2 +1 ' > — p forms of degree p and N = p ( p ~ 3 *> forms of degree 2p. We 

2 i 2 <j\ 

will see below how to obtain a set of p 2 ~ quadrics generating the homogeneous 
ideal. 

One obvious, but important, property of the construction is given in the following 
lemma. This says that if (Da,tta) is a p-covering of C, then its image under the 
descent map is necessarily given by A. 

Lemma 6.2. If there is some R G C(K) such that £(R) e A • K x dF x , then there 
exists some Q G D&(K) such that 7ta(Q) = R. 

Proof: Suppose R e C(K) is such that £(R) = aAd(Q) with a e K x and Q E F x . 
Choose homogeneous coordinates : ■ ■ • : R p ) for R and write Q = e^Qi with 

Q, e K. Recall that £{R) = ^'-'^ , where u is a linear form not vanishing at 

(Ri, . . . , R p ). Then l(R±, . . . , R p ) = au(R±, . . . , R p )Ad(Qi, . . . , Q p 2). Eliminating 
as in the construction we see that 

Ri = au(Ri, . . . , R p ) ■ TtiiQi,. . . , Q p z) , for i = 1, . . . ,p, 

= au(Ri, . . -,R P ) ■ Pj(Qi, ■ • ■ ,Qp*) , for j = 1, . . . ,m -p. 

Note that au(Ri, . . . , R p ) € if x . Since i? € C, the equations above say that the 
point (Qi : • • • : Q p 2) lies in D(K) and is mapped via 7ta to R. □ 
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The association H x 3 A H> (-Da, tta) depends on the choice of basis for F over 
K. We assume all (Z?a,7ta) are constructed using the same basis (and so live in 
the same copy of P p A different choice of basis leads to objects which differ 
only by a linear automorphism of the ambient space. It is to be understood that 
this automorphism is applied to each (Z?a,tta) if we change the basis. 

When working geometrically, it will be convenient to use the basis of F over K 
given by the characteristic functions. These are the maps e x <G F = Ma.p(X, K) 
(indexed by x <E X) taking the value 1 at i and the value at all x 1 ^ x. In 
terms of this basis, ^ z 6 F \ {0} corresponds to the point z — (z x ) € P p _1 
with z-r-coordinate given by the value of z at x. We can extend to a basis for H 
over K by taking the characteristic functions on Y and identifying x € X with the 
hyperplane in Y cutting out the divisor p[x] on C. Then d(z) splits as the tuple of 
polynomials, (indexed by y <E Y) 

where as usual the product is to be taken with appropriate multiplicities. 

Lemma 6.3. Given A € H x we can explicitly compute a set ofp 2 (p 2 — 3)/2 linearly 

2 -. 

independent quadrics over K which lie in the homogeneous ideal of I? a CP . 

Remark: We are not (yet) claiming that these quadrics define Da', we have also 
not assumed that A £ H.K- 

PROOF: Under the splitting H ~ F x H 2 , write A = (Ai,A 2 ). The equation 
I — aAd(z) corresponds to the two equations 

(6.2) £1 = aA lZ p and £ 2 = aA 2 d 2 (z) . 

First consider the case p > 5. Recall that, as a Gx-set Y 2 ~ X x 
and that F may be viewed as a subalgebra of H 2 . The hyperplanes in Y 2 cut out 
divisors on C of the form (p — 2) [x] + [x + P] + [x — P] . So there is a quadratic form 
N such that d 2 (z) — z p ~ 2 N(z). We can obtain a homogeneous equation in H 2 by 
taking the ratio of the two equations in (|6.2|) and multiplying through by z 2 . We 
get 

(6.3) k.z 2 =(¥).N{z). 



To achieve the same when p = 3, recall that F corresponds to the G^-set X 
consisting of the 9 flex points while H 2 corresponds to the Gk -set Y 2 consisting of 
the 12 lines in P 2 passing through three distinct flex points. We can no longer view 
F as a subalgebra of H 2 . Instead we work with the etale algebra M — Map^ (Z, K) 
associated to the G^-set Z consisting of all pairs (x,y) E X x Y 2 such that x € y. 
Each flex is contained in four lines, while each line passes through three flexes so 

[M : F] = 4 and [M : H 2 ] = 3 . 

The induced norm 

d = di x d 2 : F ->• F x H 2 
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is given by d\{z) = z 3 and di{z) = Nm/h 2 { z )- So, identifying z with its image in 
M, we can write d%{z) = zN(z) for some quadratic form N . Over M we can write 
our equations as 

£i = aAiz 3 and i 2 = aA 2 zN(z) . 
Again we can obtain a homogeneous equation in M by taking the ratio. We get an 
equation 




Formally this is exactly what was obtained for p > 5. Note also that [M : K] = 
3 2 (3 2 — l)/2, while for larger p we have [H2 ■ K] = p 2 {p 2 — l)/2. So in either case, 
writing the equation out in terms of the basis over K gives p 2 {p 2 — l)/2 quadrics 
some of whose coefficients are rational functions on C . These can be eliminated 
using linear algebra over K to obtain a set of quadrics with coefficients in K which 
vanish on 

We want to count the number of independent quadrics left after eliminating. For 
this we may work geometrically. For p > 5 we can index the elements of Y by pairs 
(x, P)elx {"±ij- The nnear fo™ % splits over K as i — (i( x ,p)), where l( X) p) is a 
linear form with coefficients in K defining the hyperplane whose intersection with 
C is given by the divisor (p — 2) [x] + [x + P] + [x — P] . Note that P = Oe is allowed. 
For p — 3 we can do the same, but with the caveat that the indexing is no longer 
unique. Namely, each line y € Y2 corresponds to three pairs (x, P) G X x ffjl (we 
get one pair for each x € y). In any case, we can still use the index r x ,P) to denote 
the factor of H corresponding to the line in P 2 whose intersection with C is given 
by the divisor [x] + [x + P] + [x — P] . 

The notation is such that for distinct (x,P) € X x E ¥±ffi , we have distinct 
rational functions 

G( X .p) ■= ~ X ' P) e k(C) x 
Hx,o) 

with divisors div(G( X) p)) = [a; + P] + [x — P] — 2[x]. Over K, we can work with 
the basis of F given by the characteristic functions and use (z x ) for coordinates on 
P p _1 . In terms of these and the G( x p) the homogeneous equation (|6.3p corresponds 
to a system of equations 

(6-4) G(x,P) ' z x — &(x,p) ' z x+pz x -p , 

parameterized by (x,P) G ^^x} ' wnere f° r simplicity we have denoted A^p) / A^ q) 
by A^p). 

For fixed x, the (p 2 + l)/2 linear forms tr x ,p), with P G S[p]/{±1}, all define 
hyperplanes meeting C in x with multiplicity at least p— 2. This gives p— 2 nontrivial 
relations among them. The matrix given by the coefficients of the i( x ,p) {ui , ■ • ■ , u p ) 
has rank < p — (p — 2) —2. On the other hand, the rank must be greater than one 
since these do not all define the same hyperplane. This introduces a dependence 
among the G( x py Alternatively one can argue that the functions G/ x> p-\ are all in 
the Riemann-Roch space C(2[x\) which has dimension 2. 

In any event, if we fix Pq G E[p] \ {0}, then for any P G E f. |\\°^ ; we can find 
ap, bp G K such that 

G( x ,p) = apG( XtPo ) + bp . 
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Using this to eliminate the G( x> p\ from (|6.4|) we obtain a set of quadrics 

«p^(i,p„) • z x+ p z x -p +bp ■ z 2 = A( X ,P) ' z x+pz x -p , 
parameterized by P € E lp]\{u^± p o} an j w j tn coemc i en t s i n J{. Since A^ xP ^ ^= 0, 
these are necessarily independent. Note also that the monomials appearing in these 
quadrics are all of the form z x +qz x ^q for some Q 6 i?[p]/{±l}. A different choice 
for x leads to quadrics involving a disjoint set of monomials. So, in total this gives 
a set of f/=X ■ # ^MXfo^-Po} ^ = p 2 (p 2 — 3)/2 independent quadrics as required. □ 

There is an obvious action of F x on (F\ {0}) / K x by multiplication. The choice 
of basis gives an identification of the latter with the -ftT-points of P p2 ~ 1 and hence 
a representation 

F x 3 tp a £ PGL P 2 = Aut(P p2 " 1 ) . 

Working with the basis of F given by the characteristic functions, the representation 
takes the particularly simple form a = (a x ) t— > Diagona^a^); this is just coordinate- 
wise multiplication. Assuming we are working with a basis for F over K , we see 
that for any extension of fields K' /K , 

ip a e PGL P 2(^') e (F® K K') X . 

Lemma 6.4. For any A G -ff x and a £ -F x , £/ie action of a on P p _1 induces an 
isomorphism (of C -schemes) (p a : Dg/ a \.A — > Da- 

Corollary 6.5. Let A 6 H x and (-Da, ""a) &e </ie corresponding C-scheme. The 
coset ATi {) K C H x / K x dF x parameterizes a set of twists of (Da,^a) as a C-scheme 
defined over K up to K -isomorphism. 

Proof: To prove the lemma, use that D d ( a y A is defined by the equation I = 
d(a)Ad(z). If Q £ Dq^.a is any point mapping to, say P £ C, then the point 
aQ £ PP 2-1 evidently satisfies 

Ad(aQ) = Ad(a)d(Q) = £(P) mod K x . 

The equivalence here is meant for any choices of coordinates for P and Q. This 
means aQ is a point of Da lying above P. This proves the lemma. 

The lemma implies that if A £ H x , then the C-schemes corresponding to the 
elements of AT-L° K = A(dF x ) GK are all twists of (Da,^a)- The isomorphism 
(p a : -Da( Q )A - > Da is defined over K if and only if a £ F x in which case d(a)A 
and A differ by an element of K x dF x . So AT-L° K parameterizes the corresponding 
twists in ATl K up to X-isomorphism. □ 

By definition, any twist of a p-covering is a p-covering, so we can reduce to the 
geometric situation. To prove the theorem, it is enough to show that there is some 
A £ Hk such that (Da, tta) is a p-covering of C defined over K. The proof of the 
following lemma also shows that for A £ T-Lk, the p 2 (p 2 — 3)/2 quadrics obtained 
in Lemma 16.31 generate the homogenous ideal of Da- 

Lemma 6.6. There exists some A £ such that (Da, it a) is a p-covering of C. 
Proof: For this we may work over K, using the basis given by the characteristic 

2 _ -I 

functions and z x for coordinates on P p . Choosing any flex point xo £ X as origin, 
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we may consider (C, xq) as an elliptic curve over K. Denote the multiplication by p 
map on (C, xq) by ir : C — > C. This is a p-covering of C. We are going to find some 
A £ H x representing the image of (C, it) under the descent map and then show 
that the scheme Da produced by the construction above is equal to the image of 
(C, it) under a certain embedding into P p _1 as a genus one normal curve of degree 

P . 

To compute the image of (C, it) under the descent map we use the definition. 
Namely, we embed C in P p _1 in such a way that the pull-back of any flex point is 
a hyperplane section. This amounts to finding a basis for the Riemann-Roch space 
of the divisor 7r*[xo]. For each x £ X, we can find a rational function G x £ k(C) x 
with divisor div(G x ) = 7r*[a;] — 7r*[a;o]- For existence of these functions, note that n 
is multiplication by p on the elliptic curve (C, xq) and recall that the Weil pairing 
on (C, xq) is defined in terms of such functions (see [40l III.8] ) . By Riemann-Roch 
the dimension of C{tt*[xq\) is p 2 = #X. Clearly the G x lie in the Riemann-Roch 
space, so it will suffice to show that they are linearly independent. This follows from 
the definition of the Weil pairing; the G x are eigenfunctions for distinct characters 
with respect to the action of X — C[p) by translation, (see the first paragraph of 
the proof of [13 II, Proposition 3.3]). 

Thus we may define an embedding of C into P p via 

g:C3P^(G x (P)) xeX £P p2 - 1 . 

It is evident that the pull-back of any flex point x £ X by tt is the hyperplane 
section of g(C) C P p _1 cut out by z x — 0. Let Q £ C \ C[p 2 } be any point, with 
projective coordinates g{Q)- By the definition of the descent map, the image of 
(C, tt) under the descent map is represented by the A £ H y such that 

(6.5) i(n(Q)) = Ad(g(Q)) . 

By definition we have that A £ T-L^- 

Equation (|6.5[) was also used to construct So it is clear that 7ta ° g = it 

on C \ C[p 2 ] and that the image of this open subscheme under g is contained in 
Da- Since Da is projective (hence complete), this is then true on all of C. We 
conclude that g{C) c Da and that it a ° g = T. On the other hand, g(C) is a 
genus one normal curve of degree p 2 . Its homogeneous ideal can be generated by 
a K- vector space of quadrics of dimension p 2 {p 2 — 3)/2. We have already found a 
set of p 2 (p 2 — 3)/2 linearly independent quadrics vanishing on Da in Lemma 16.31 
so we must have g(C) = Da- Thus (Da,tta) is a twist of (C,tt). This completes 
the proof. □ 



7. Computing the p-Selmer Set 

We shift our focus now to the arithmetic situation. We specialize to the case that 
K = k is a number field. We assume that C is an everywhere locally solvable genus 
one normal curve of degree p defined over k. Recall that local solvability implies 
that Pic(C) = Pic(C) Gfc and that Cov (p) (C/fc) ^ 0. Thus all of the material of 
Sections S] - [6] applies to C. 

An element in an etale fc-algebra A ~ Yli Ki w iU be called integral if its image in 
each Ki is integral. We assume that the linear form I defining the descent map and 
all polynomials appearing in the model for G have integral coefficients. We further 
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assume that the constants c E k x and /? E H% given bv !5.10l are integral. All of this 
can be achieved by scaling. We denote the completion of k at a prime v by k v . We 
attach a subscript v to any object defined over k to denote the corresponding object 
over k v obtained by extension of scalars. For example H v — H <g> k v , H v = Hk„, 
C v = C ®k v , and so on. 

7.1. The algebraic Selmer set. The descent map allows us to identify Sel^ (C/fc) 
with its image in H x /k x dF x . We now determine the image. This gives an alge- 
braic presentation of the p-Selmer set, which can be computed fairly directly. 

Consider the following diagram: 

Pic(C) H x /k x 8F x 

Y[ v TGSv 

u v Pic(c„ ) — 2^ Dti H x jK dF * . 

If (D,tt) E Sel^(C/fc) is an everywhere locally solvable p-covering of C, then its 
image, $((£), 7r)) £ H x /k x dF x , has the property that it maps under FT res„ into 
the subset Y[ v < ^ > t)(Pic 1 (C l ,)) C n^^- This suggests the following definition. 

Definition 7.1. The algebraic p-Selmer set of C associated to $ is the set 

Se$ g (C/k) = {A £ H x /k x dF x : res„(A) G ^(Pic 1 ^)) for all v } . 

Theorem 7.2. The descent map gives a one to one correspondence between the 
p-Selmer set of C and the algebraic p-Selmer set of C . 

Proof: The defining property of the descent map shows that the image ofSel (p) (C//fc) 
is equal to Sel^(C/fc) n Hk- We know that the descent map is injective by Propo- 
sition l5^4l so it suffices to show that Sel^(C/fc) C Hk- This follows from Corollary 
15.91 ^(Pic^CV,)) C Hv and any element of H x /k x dF x which restricts into H v 
(for some v) is an element of Hk- d 

One can formulate the same definition for divisor classes of degree 0. 
Definition 7.3. The algebraic p-Selmer group of E = Jac(C) is 

Sel^E/k) = {Ae H x /k x dF x : res„(A) £ $„(Pic°(C„)) for all v } . 

Note that bv !5.9| Se\^ g (E/k) C Since Hk is a principal homogeneous space 
for Hi, the same is true of the corresponding Selmer objects. 

Lemma 7.4. If the algebraic p-Selmer set of C is nonempty, then it is a coset of 
the algebraic p-Selmer group of E inside H x / k x dF x . 

Proof: By assumption C is everywhere locally solvable. So, everywhere locally 
the group of /^-rational divisor classes of degree 1 on C is a coset of the group of 
fc„-rational divisor classes of degree 0. Since & v is a homomorphism, the same is 
true of their images in H x jk x dF x . If the algebraic p-Selmer set of C is nonempty, 
then these cosets can be simultaneously defined by some global element of Hk- □ 
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Although it is not reflected in the notation, Sel^ (C / k) depends on our choice of 
linear form I used to define the descent map and the algebraic p-Selmer group of E 
depends on C. The next proposition shows, however, that the image of Sel~j g (E/k) 
in H 1 (fc, E[p\) does not. 

Proposition 7.5. The inclusion T~i\ ~ C 1 - °->- H 1 (fc, E[p\) identifies the algebraic 
p-Selmer group of E with the p-Selmer group of E. 

Proof: We identify U° k with its image in H^fc, E[p\) and E with Pic°(C). To show 
that the algebraic Selmer group is contained in the Selmer group we use Lemma 
15.71 This says that the images of 3??j|pi c °(c) and the connecting homomorphism S v 
from the Kummer sequence of E/k v are the same. So clearly the algebraic Selmer 
group is contained in the Selmer group. 

For the reverse inclusion it suffices to show that C Hi ~ . So we 

need to show that elements of the Selmer group are orthogonal to C with respect 
to the Weil pairing induced cup product of level p. Using that the cup product is 
the bilinear form associated to the obstruction map we have 

C Up C = Ob p (C + C) - Ob p (C) - Ob p (C") , 

for any C € H 1 (/c, If C is everywhere locally solvable then so is C + C 

(because the Selmer group is a group). Having points everywhere locally implies 
trivial obstruction, so all the terms on the right-hand side vanish as required. □ 

7.2. Computable description. In order to compute the algebraic Selmer set ex- 
plicitly, we need a method for determining these local images. For a given v, this is 
relatively straight forward, but there are infinitely many primes to deal with. We 
will show that, for all but finitely many primes, the local image can be identified 
with the unramified subgroup. This feature, which is typical of explicit descents, 
allows us to apply classical (and effective) finiteness theorems in algebraic number 
theory to reduce the problem to a finite computation. We note also that since p is 
assumed to be odd we can ignore all archimedean primes. 

For a completion k v of A; at a non-archimedean prime, we use &" nr to denote the 
maximal unramified extension of k v . If £ is an element of some object defined over 
k, we say that £ is unramified at v if £ becomes trivial upon extension of scalars 
to fc" nr . For Galois cohomology groups H (fc, — ), this coincides with the usual 
definition that £ be in the kernel of the restriction map to H 1 ( fc" nr , — ) . For example , 
a class in F x /k x F xp represented by S is unramified at v if 5 e /c" nrx (F ® fc" nr ) xp 
or, equivalently if its image under the map F x /k x F xp H (k, jjb p {F)/ fi p ) — > 
H 1 (fc" nr , n p (F v ) I n p ) is zero. For a finite set of primes S and a k- Algebra A we use 
A(S,p) to denote the the finite group of elements of A x /A xp which are unramified 
outside S. 

The first step is to identify a suitable finite set of bad primes. To that end, let 
F' denote the field extension of k obtained by adjoining the coordinates of all flex 
points of C. We refer to F' as the splitting field of X. We can write the linear form 
used to define the descent map as I — (£1,(2) under the splitting H ~ F x H 2 - Here 
t\ defines a hyperplane section meeting C at a generic flex point with multiplicity 
p. Over F', all flex points are defined, and so l\ splits as a p 2 -tuple, (£ x )x£X of 
linear forms with coefficients in F' each defining the hyperplane meeting C only at 
the flex x £ X. 
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At any non-archimedean prime w of F' , we can reduce the £ x modto. Since this 
linear form may vanish modw, it may fail to define a hyperplane section of the 
reduction of C modw. In some sense this is a situation we would like to avoid. We 
will refer to a prime v of k as a prime of bad reduction (resp. good reduction) for 
£ if there is some (resp. no) prime w\v of F' for which this occurs. 

Recall the constant c £ k x defined in Lemma \5. 101 By scaling we may assume c 
to be integral. 

Lemma 7.6. Let v be a non-archimedean prime of k which is of good reduction for 
both C and £ and which is prime to both p and c. Then 4>„ (PicJ, (C)) C H* / k* dF* 
is contained in the unramified subgroup. 

Proof: Let F' be the splitting field of X. By the criterion of Neron-Ogg-Shafarevich, 
the primes which ramify in the extension F'/k are either primes of bad reduction 
for C or lie above p. In particular, if v is as in the statement, then it does not 
ramify in F' . 

Now we claim that if v does not ramify in F' , then for all A £ 1-L V we have 
A e Hv is unramified <^=> pr : (A) £ F* / K* F* p is unramified. 
This follows from the fact that for these 'good primes' the map 

y ^iunrx i j^unix punrxp 

induced by projection onto the first factor of H ~ F x Hi is injective. To see the 
injectivity recall that the fibers of this map (see the diagrams in I5.3|) are parame- 
terized by 

K _ H°(fcr,(d 2 (^))) 

9 2 (H°(fcr r ,^)) ' 

As v does not ramify in F', all flex points are defined over fc" nr . So the actions on 
the modules appearing here are trivial. Since fi p C kerc>2, we have d2((i p (F)) = 
d2(n P (F) I Hp) . So the quotient is trivial. 

To prove the lemma, it now suffices to show that the image of the composition 

Pi c \C v )^U v ^FX/kZF*P 

is unramified. For this it will be enough to show that this is true of any point 
P G C{k v ) which is neither a zero nor a pole of £\. For this we can choose primitive 
integral coordinates for P (i.e. homogeneous coordinates with valuations that are 
non-negative but not all positive) and consider £\(P) £ (F&k v ) x . The flex algebra 
F®k v splits as a product of extensions of k v . Since v \ p, in order that the image of 
P be unramified it is sufficient that the valuation of £\ (P) in each of these factors 
is a multiple of p. 

Fix some factor K v . For any prime tx> of F' extending 0, we get an unramified 
tower of fields k v C K C F^. Let v m be the normalized valuation on F' m . Over 
F', £\ splits as (£ x )xex and, since the extensions are all unramified, it suffices to 
show that v m {£x{P)) = modp for each x £ X. 

For this we make use of the norm condition. Since v \ c, its valuation satisfies 
the congruence v m (c) = modp. Hence, 




(c) = modp . 
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Each summand appearing on the left is nonnegative. To complete the proof it 
suffices to show that at most one can be positive. 

Since v is of good reduction for I, the reduction of each £ x defines a hyperplane 
meeting C only at the image a; of x on C. So v m (l x {P)) > if and only if P and x 
have the same image under the reduction map. On the other hand, the images of 
the flex points modulo to are all distinct since v is of good reduction for C and is 
prime to p (the images of these flex points are the flex points of the reduced curve) . 
So v n {ix{P)) can be positive for at most one id. This completes the proof. □ 

Proposition 7.7. Let S be the set of primes of k containing all non-archimedean 
primes dividing p or c, all primes of bad reduction for C or L Let denote the 
subgroup ofHk consisting of elements that are unramified outside S. Then 

Sel^C/k) = {AeH s : res v {A) £ ^(Pic 1 (<?„)), for all v £ S } . 

Proof: Let Z denote the set in the statement. The previous lemma shows that 
Z contains SeL^(C/fc). To show that the reverse inclusion holds, we may assume 
that Z is nonempty. Let A £ Z and v ^ S. To show that A 6 Sel^(C/fc) we must 

show that res„(A) e ^(Pic^O,)). Choose any P € Pic*(C). Then both $„(P) 
and res„(A) are unramified, so & V (P) ■ res„(A) -1 is in the unramified subgroup of 

I/O 

Since v is a prime of good reduction for C, it is also a prime of good reduction 
for its Jacobian. For primes outside S, the image of the connecting homomorphism 
5 V : E(k v ) — > H 1 (fc„, E[p\) is equal to the unramified subgroup. On the other 
hand. HTT1 savs that : Pic (C„) — > C H 1 (fc„, E\p\) coincides with connecting 
homomorphism. It follows that <&„(Pic°(C„)) is equal to the unramified subgroup 
of T-L®. Hence there exists some Q e Pic°(C) such that $„(Q) = $„(P) res^(A)- 1 . 
Since & v is a homomorphism we have res„(A) = $„(P — Q), which completes the 
proof since P-QePic* ((7). □ 

7.3. The Algorithm. The theory above gives rise to the following algorithm for 
computing a set of representatives for the algebraic p-Selmer set of C. The output 
is a collection of elements in H y . Using the methods of Section [51 these can then 
be turned quite easily into explicit models as genus one normal curves of degree p 2 . 
Thus we have an algorithm for performing explicit second p-descents. For p = 3 
and k = Q, our implementation of this algorithm has been contributed to Magma 
[2]. For practical applications it is also important to find 'nice models' (e.g. one 
with small coefficients - see [TS] for details). With the help of Tom Fisher and 
Michael Stoll we have implemented some ad hoc methods. However, there is much 
room for both theoretical and practical improvement. 

For larger p > 5 the algorithm is currently impractical for two reasons. The 
first of these is the, largely unavoidable, computation of S'-class and -unit group 
information in F. With the current state of the art, this becomes somewhat pro- 
hibitive already for p — 5. There is hope, however, that this will become feasible for 
larger p in the near future as computing power and algorithms in algebraic number 
theory improve. The second arises from the fact that the degree of the algebra H2 
is simply too large. Generically it is a number field of degree p 2 (p 2 — l)/2 over k. 
The algorithm does not, however, require class and unit group information in H 2 - 
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The most expensive operations required are the extraction of p-th roots. Even so, 
this quickly becomes impractical. 
Compute Sel^(C/fc): 

(1) Compute the algebras F and H2, the map 82 : F — )• H2, the linear form £, 
the constants c£ k x , (3 £ Fl£ , and the set S of bad primes. 

(2) Let Vi C F x be a (finite) set of representatives for the unramified outside 
S subgroup of F x /k x F x P. 

(3) Let V 2 = {5 £ Vx : N F/k {8) = c rnodQ*?} . 

(4) For each v £ S, determine the local image $(Pic 1 (C t) )) C H v . 

(5) Let V 3 = {5 £ V 2 :Vv£ S, ves v (6) £ pr 1 ($(Pic 1 (C„))) } . 

(6) Let V4, be the set of (5,e) £ F x x H x such that 5 £ V 3 and e £ is 
a p-th root of 9 2 (<5)//3, modulo the equivalence (S, e) ~ (S,e') e/e' £ 

d2((p p (F)/v P ) Gk )- 

(7) Let V 5 = {(S,e) £V A :Vi;eS, ves v {5,e) £ ^(Pic^C)) } . 

(8) return V 5 . 

Remark: The reason for including steps (3) and (5) is to reduce the size of V\ as 
much as possible before proceeding to step (6) where one has to extract p-th roots. 

Let us prove that the algorithm returns a set of representatives for the algebraic 
Selmer set. The equivalence in step (6) is included to ensure that the (S,e) £ V5 
represent distinct classes modulo k x dF x . In the proof of Lemma [71)1 we have seen 
that, for primes not in S, a class in H x /k x dF x is unramified if and only if its 
image in F x / k x F xp is unramified. Moreover the elements of V5 are in T-Lk by 
Lemma [5.91 since they restrict to T-L v for some v £ S 7^ 0. It follows that V5 is a 
set of representatives for {A £ Hs '■ res„(A) £ Pic 1 (C„),Vw e S}, which is equal 
to Sel^(C/fc) by Proposition [LJj 

We now describe each step in more detail. 
Step 1. This is straightforward. 

Step 2. This is the bottleneck in the computation. Let !Fs denote the unramified 
outside S subgroup of F x /k x F xp . It fits into an exact sequence 

k{S,p) -> F(S, P ) -> F s -> ■ \ -> ) ' \ . 

For a derivation of this sequence and a description of how to compute Fs see [3TJ 
12.8]. 

Step 3. Since we have already computed k(S,p), this can be accomplished very 
quickly using linear algebra over F p . 

Step 4- Using Hensel's Lemma it is relatively easy to show that H, v is finite and that 
the maps <fr v : Pic^,(C) — > % v are locally constant. Moreover, one can determine 
the size of the image by considering the factorization of the p-division polynomial 
of the Jacobian over k v (see for example [3H Propsition 3.8] or [35j Proposition 

To compute the local image it thus suffices to find the images of sufficiently many 
independent points. It is actually easier to determine independence by considering 
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the images in T~i v . This is valid since the descent map is injective. Moreover, since 
the descent map is affine it suffices to find a set of images in T~i v which span a space 
of the appropriate dimension. In practice we simply compute the images of random 
points until their images generate a large enough space. 

Step 5. Having computed J-s and F* /k*F* p this can be accomplished using linear 
algebra over F p . 

Step 6. Extracting the p-th roots is straightforward (if a bit costly - it is here that 
the degree of Hi becomes a problem). By 'modulo the equivalence...' we mean that 
we keep one (<5, e) in each equivalence class. To determine equivalence, one needs 
to determine (/j, p (F) / H P ) and its image under 82- 

Step 7. This is accomplished as in step (5). 

8. Examples 

8.1. An example with IHpJ 00 ] = Z/9Zx Z/9Z. As a first example, let us consider 
the smallest elliptic curve over Q (ordered by conductor) with analytic order of III 
divisible by 81. This is the curve 

E : y 2 + y = x 3 - x 2 ~ 14556197783a; - 675953651051907 

of conductor 5075 (labelled 5075d3 in Cremona's database [E]). One can show 
that E(Q) — 0, using either a 2-descent or analytic means to determine the rank. 

A 3-descent on E produces four plane cubic curves, each of which represents an 
inverse pair of nontrivial elements in Sel (3) (£/Q), 

... 

Se\ {3) {E/Q) ~ m(E/Q)[Z] ~ Z/3Z x Z/3Z, 

and each cubic is a counter-example to the Hasse principle. Since the analytic 
order of HI (E/Q) is 81, we expect that #Sel (3) (C/Q) = 9 for each cubic C. 
This is confirmed by performing a second 3-descent. Note that since the order 
of 3UI(E/Q)[9]/UI(E/Q)[3] is a square it suffices to do the computation for a sin- 
gle cubic. Each of the 9 elements computed in Sel^(C/Q) correspond to a pair of 

inverse elements of order 9 in Se\ (9) (E/Q) ~ UI{E/Q)[9] ~ Z/9Z x Z/9Z. 

Alternatively, we may appeal to the isogeny invariance of the Birch and Swinnerton- 
Dyer conjecture (see [5]). Namely the conjecture either correctly predicts ord3(HI(£'/Q)) 
for every curve in the isogeny class, or for none of them. In this example the other 
two curves in the isogeny class, 5075dl and 5075d2, are predicted to have HI of 
order 1 and 9, respectively. This may be verified by first and second 3-descents, 
and shows in addition that there are no elements of order 27 in UI(E/Q). 

Remark: There is a degree 9 isogeny between E and 5075dl. As the anonymous 
referee astutely noted, this gives a more direct proof of the fact that there are 
no higher order elements in HI. Namely multiplication by 9 factors through the 
Shafarevich-Tate group of 5075dl which is trivial. 
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8.2. An example with irreducible mod 3 representation. The first elliptic 
curve over Q (ordered by conductor) with irreducible mod 3 representation and 
analytic order of III divisible by 81 has Cremona reference 15675f 1 and minimal 
Weierstrass model 

E : y 2 + y = x 3 - x 2 - 9002708a; - 10393995307 . 

A second 3-descent shows that the III [9] ~ Z/9Z x Z/9Z. Using the method 
described in Section [6] we can produce models for the elements of order 9 as genus 
one normal curves of degree 9 in P 8 . In the appendix we give 27 symmetric matrices 
which corresponding to 27 quadratic forms which give such a model. The curve 
defined by the vanishing of the quadratic forms is everywhere locally solvable, yet 
has no rational points over any number field of degree indivisible by 9. To our 
knowledge this is the largest prime power to date for which such an example has 
been produced^- 

8.3. An example with III = Z/12Z x Z/12Z. As a final example we offer the 
following theorem which, in addition to some very deep results in the direction of 
the Birch and Swinnerton-Dyer conjecture, brings to bear many of the currently 
available algorithms for explicit descents on curves of genus one. 

Theorem 8.1. The full Birch and Swinnerton-Dyer conjecture holds for the elliptic 
curves 

E : y 2 = x 3 + 7 3 • 61 3 • 97 4 , and 

E' : y 2 = x 3 - 3 3 • 7 3 • 61 3 • 97 4 

defined over Q. In particular, UI(E/Q) ~ UI(E' /Q) ~ Z/12Z x Z/12Z. 

The hard part of the proof is taken care of by the existing partial results in 
the direction of BSD. The role of descent is to compute the p-primary parts of the 
Shafarcvich-Tate groups at the primes 2 and 3. Note that these curves are related 
by the 3-isogeny 

, „ . fa 3 + 2 2 7 3 61 3 97 4 a 3 b - 2 3 7 3 61 3 97 4 6\ _ 
h:E3(a,b)^[ ~ 2 , ~ 3 )sE. 

So the validity of BSD for either curve implies its validity for the other. 

One can check that the values of the L-series of E and E' at s = 1 are (equal and) 
approximately 5.5542. Results of Coates and Wiles then imply that the Mordell- 
Weil groups are finite . One easily checks that there is no nontrivial torsion on 
either, so the Mordell-Weil groups are trivial. The predicted orders of III( 
and HI(E'/Q) are the numbers 

m an {E')= Le ' (1) 



n(E')-n p \ Am C P (E>)> 

where Lz(s) is the Hasse-Weil L-function associated to £, ft(£) is the real period, 
C p {£) denotes the Tamagawa number of £ at p and A(£) is the discriminant (note 
that the regulators and torsion subgroups are trivial for both curves). The real 



^One can produce examples of order 12 by combining examples of orders 3 and 4 using the 
method of [23]. 
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period of E is Sl(E) s» 0.0096427 and the only Tamagawa number not equal to 1 is 
C 7 (E) = 4. This gives 

5.5542 

man(S) W (0.0096427) • 4 ~ 144 

The real period of E' satisfies fl(E) — 3 ■ fl(E') and the nontrivial Tamagawa 
numbers are C 3 (E') = 3 and C 7 {E') = 4. Thus HL an (E') « 144 as well. 

It is known that UI an (E) and HI all (i?') are rational numbers of (explicitly) 
bounded denominator, so taking the computations to sufficiently high precision we 
conclude that they are in fact equal to 144. Rubin's result [33] then implies that 
HI(E/Q)\p] = for all primes p not dividing lH an (E) or the order of the group 
of units in the ring of integers of the field of complex multiplication. The same 
holds for UI(E'/Q). These curves have CM by \/— 3, so we conclude that both 
Shafarevich-Tate groups are annihilated by some power of 6. 

After applying these deep results, we are left only with the task of computing 
the 2- and 3-primary parts of 1TI(£ , /(Q) and III(.E'/Q). Since the validity of BSD 
for a given elliptic curve is actually a property of its isogeny class, it will suffice to 
perform the computations for either curve. We describe the computations for E. 
The computations for E' are similar (and equally feasible). 

The 2-primary part. One needs explicit first and second 2-descents to produce mod- 
els for the elements of order dividing 4 and then a third 2-descent to show that there 
are no elements of order 8. The 2-descent on E yields models for the 3 nontrivial 
elements of UI(E /Q)[2] as double covers of P 1 : 

d : u\ = 130174^ - 71004uJ - 426024u? + 2011780ui - 390522 , 
C 2 : u\ = 11834?4 + 260348m? - 710040^ + 1372744ui + 3999892 , 
C 3 : u\ = 5917?4 + 29585u? - 177510m? + 804712wi + 562115 . 

For each Cj a second 2-descent will produce a pair of quadric intersections, each 
representing a pair of inverse elements of order 4 in UI(E/Q). For example, 

Sel*- 2 ) (C3/Q) is of order 4 and represented by the two curves (for each their are 
two choices for the covering map) 



Di = 
D 2 = 



2z\ + 14ziZ2 — 3^2 + 4ziZ3 — 2Z2Z3 + 5z| + 8212:4 + 22224 — 82324 — 15^1 = 

242i + 82122 - 2222 + 362123 + I82223 + 632| ~ 542124 - 242224 + 422 3 2 4 + 14^1 = 
3zf + 22122 + 322 + 62123 — 22223 — 82! + 62124 + 2422 24 — 13«| = 

62? + 862122 - 202I - 182123 + 22223 + isz'i - 182124 - 222224 - 62324 - 422! = 



One then uses Stamminger's method for third 2-descent which shows that none of 
the elements of order 4 lift to elements of order 8. It follows that the 2-primary 
part is m(E/Q)[2°°} ~ Z/4Z x Z/4Z. 

The 3-primary part. For this we can make use of the 3-isogeny. A 3-isogeny de- 
scent (as described in [36]) computes that Sel (h) (E/Q) ~ Sel^'^E'/Q) ~ Z/3Z. 
Since the Mordell-Weil groups are trivial these Selmer groups are isomorphic to 
the corresponding torsion subgroups of the Shafarevich-Tate groups. The exact 
sequence 



• - IS) - Sd ""< £ « 1 - s * m w A s -'"" ,(£ '«» - mmim - 
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reduces to 

(8.1) -> Scl ( ' l) (£;/Q) -> Scl (3) (£/Q) -> Sd (fc,) (^/Q) -> 0, 

which splits since Sel (3) (£/Q) is 3-torsion. We conclude that UI(E/Q)[3] ~ Z/3Zx 
Z/3Z. 

The 3-isogeny descent (implemented in Magma ) is also explicit in that it produces 
the projective plane cubic 

C : u\ + Au\ + 4017643dj = Au\u 2 + 3u lU 2 2 

representing the pair of nontrivial elements in Sel^(-E/Q). This also represents an 
inverse pair of nontrivial elements in Sel (3) (£VQ). In order to show that UI(E/Q)[3°°] ~ 
Z/3Z x Z/3Z it will be enough to show that Scl (3) (C/Q) = (since UI(E/Q)[3°°] 
is finite, its order is a square). 

For this we do a second 3-dcscent. The reducibility of E[3] translates into a 
splitting of the flex algebra. We find that F is isomorphic to the product of the 
cubic and sextic number fields with defining polynomials 

f(t) = t 3 - At 2 - it + 4 and 

f(t) = t 6 + 2408704t 3 + 5533080062500 

and the set of bad brimes is S = {2, 3, 5, 7, 61, 97}. Despite the splitting, computa- 
tion of F(S, 3) takes a couple hours of processor time. Having accomplished that 
however the remaining computations are very fast. In fact, the computation can 
be completed without ever using iJ 2 - The image of the 3-Selmer set under pr x is 
contained in the set of all 5 € F x /Q x F x3 such that 

(1) S is unramificd outside S, 

(2) N F/q (5) = 7 2 61 2 97 modQ x3 and 

(3) VveS,rcs v (S)ewiMC(Q v )). 

which turns out to be empty. It follows that the 3-Selmer set of C is empty and 
thus that the 3- primary part of U1(E/Q) is isomorphic to a product of two cyclic 
groups of order 3. 
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9. An element of order 9 in III for the curve 15675f 1 
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